Merge pull request #3025 from flatcar/buildbot/weekly-portage-stable-package-updates-2025-06-16

Weekly portage-stable package updates 2025-06-16

.github/workflows/portage-stable-packages-list

@@ -304,6 +304,7 @@ dev-python/colorama
 dev-python/crcmod
 dev-python/cryptography
 dev-python/cython
+dev-python/dependency-groups
 dev-python/distlib
 dev-python/distro
 dev-python/docutils
@@ -357,6 +358,7 @@ dev-python/setuptools-scm
 dev-python/six
 dev-python/snakeoil
 dev-python/tomli
+dev-python/tomli-w
 dev-python/tree-sitter
 dev-python/trove-classifiers
 dev-python/truststore
@@ -398,6 +400,7 @@ eclass/db-use.eclass
 eclass/desktop.eclass
 eclass/dist-kernel-utils.eclass
 eclass/distutils-r1.eclass
+eclass/dot-a.eclass
 eclass/eapi8-dosym.eclass
 eclass/eapi9-pipestatus.eclass
 eclass/eapi9-ver.eclass
@@ -473,6 +476,7 @@ eclass/shell-completion.eclass
 eclass/ssl-cert.eclass
 eclass/strip-linguas.eclass
 eclass/subversion.eclass
+eclass/sysroot.eclass
 eclass/systemd.eclass
 eclass/tmpfiles.eclass
 eclass/toolchain-autoconf.eclass

changelog/security/2025-06-23-weekly-updates.md

@@ -0,0 +1,9 @@
+- bind ([CVE-2024-11187](https://www.cve.org/CVERecord?id=CVE-2024-11187), [CVE-2024-12705](https://www.cve.org/CVERecord?id=CVE-2024-12705))
+- containerd ([CVE-2025-47291](https://www.cve.org/CVERecord?id=CVE-2025-47291))
+- glib ([CVE-2025-4373](https://www.cve.org/CVERecord?id=CVE-2025-4373))
+- go ([CVE-2025-22873](https://www.cve.org/CVERecord?id=CVE-2025-22873), [CVE-2025-4673](https://www.cve.org/CVERecord?id=CVE-2025-4673), [CVE-2025-0913](https://www.cve.org/CVERecord?id=CVE-2025-0913), [CVE-2025-22874](https://www.cve.org/CVERecord?id=CVE-2025-22874))
+- jq ([CVE-2024-23337](https://www.cve.org/CVERecord?id=CVE-2024-23337), [CVE-2024-53427](https://www.cve.org/CVERecord?id=CVE-2024-53427), [CVE-2025-48060](https://www.cve.org/CVERecord?id=CVE-2025-48060))
+- libxml2 ([CVE-2025-32414](https://www.cve.org/CVERecord?id=CVE-2025-32414), [CVE-2025-32415](https://www.cve.org/CVERecord?id=CVE-2025-32415))
+- python ([CVE-2025-4516](https://www.cve.org/CVERecord?id=CVE-2025-4516), [CVE-2024-12718](https://www.cve.org/CVERecord?id=CVE-2024-12718), [CVE-2025-4138](https://www.cve.org/CVERecord?id=CVE-2025-4138), [CVE-2025-4330](https://www.cve.org/CVERecord?id=CVE-2025-4330), [CVE-2025-4517](https://www.cve.org/CVERecord?id=CVE-2025-4517))
+- requests ([CVE-2024-47081](https://www.cve.org/CVERecord?id=CVE-2024-47081))
+- vim ([CVE-2025-1215](https://www.cve.org/CVERecord?id=CVE-2025-1215), [CVE-2025-22134](https://www.cve.org/CVERecord?id=CVE-2025-22134), [CVE-2025-24014](https://www.cve.org/CVERecord?id=CVE-2025-24014), [GHSA-63p5-mwg2-787v](https://github.com/vim/vim/security/advisories/GHSA-63p5-mwg2-787v), [CVE-2025-27423](https://www.cve.org/CVERecord?id=CVE-2025-27423), [CVE-2025-29768](https://www.cve.org/CVERecord?id=CVE-2025-29768))

changelog/updates/2025-06-23-weekly-updates.md

@@ -0,0 +1,55 @@
+- SDK: cmake ([3.31.7](https://cmake.org/cmake/help/v3.31/release/3.31.html#id1))
+- SDK: go ([1.24.4](https://go.dev/doc/devel/release#go1.24.minor))
+- SDK: meson ([1.7.2](https://github.com/mesonbuild/meson/commits/1.7.2/))
+- SDK: qemu ([9.2.3](https://wiki.qemu.org/ChangeLog/9.2))
+- SDK: rust ([1.87.0](https://releases.rs/docs/1.87.0/) (includes [1.86.0](https://releases.rs/docs/1.86.0/)))
+- azure, dev, gce, sysext-python: mpdecimal ([4.0.1](https://www.bytereef.org/mpdecimal/changelog.html#version-4-0-1xs))
+- base, dev: bind ([9.18.37](https://bind9.readthedocs.io/en/v9.18.37/notes.html#notes-for-bind-9-18-37) (includes [9.18.36](https://bind9.readthedocs.io/en/v9.18.36/notes.html#notes-for-bind-9-18-36), [9.18.35](https://bind9.readthedocs.io/en/v9.18.35/notes.html#notes-for-bind-9-18-35), [9.18.34](https://bind9.readthedocs.io/en/v9.18.34/notes.html#notes-for-bind-9-18-34), [9.18.33](https://bind9.readthedocs.io/en/v9.18.33/notes.html#notes-for-bind-9-18-33), [9.18.32](https://bind9.readthedocs.io/en/v9.18.32/notes.html#notes-for-bind-9-18-32)))
+- base, dev: checkpolicy ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: gawk ([5.3.2](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00003.html))
+- base, dev: gcc ([14.3.0](https://lists.gnu.org/archive/html/info-gnu/2025-05/msg00004.html))
+- base, dev: glib ([2.84.3](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.3) (includes [2.84.2](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.2), [2.84.1](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.1), [2.84.0](https://gitlab.gnome.org/GNOME/glib/-/releases/2.84.0), [2.83.5](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.5), [2.83.4](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.4), [2.83.3](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.3), [2.83.2](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.2), [2.83.1](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.1), [2.83.0](https://gitlab.gnome.org/GNOME/glib/-/releases/2.83.0)))
+- base, dev: grep ([3.12](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00008.html))
+- base, dev: gzip ([1.14](https://lists.gnu.org/archive/html/info-gnu/2025-04/msg00007.html))
+- base, dev: inih ([59](https://github.com/benhoyt/inih/releases/tag/r59))
+- base, dev: iputils ([20250605](https://github.com/iputils/iputils/releases/tag/20250605) (includes [20250602](https://github.com/iputils/iputils/releases/tag/20250602)))
+- base, dev: jq ([1.8.0](https://github.com/jqlang/jq/releases/tag/jq-1.8.0))
+- base, dev: kexec-tools ([2.0.31](https://github.com/horms/kexec-tools/commits/v2.0.31/))
+- base, dev: libffi ([3.4.8](https://github.com/libffi/libffi/releases/tag/v3.4.8) (includes [3.4.7](https://github.com/libffi/libffi/releases/tag/v3.4.7)))
+- base, dev: libgpg-error ([1.53](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=66b2256de2f59c38b9cd35fb4a1b1971a6c9f3f1;hb=f9e98ed8315eaf0468870149d22c5dcf992288ec) (includes [1.52](https://git.gnupg.org/cgi-bin/gitweb.cgi?p=libgpg-error.git;a=blob;f=NEWS;h=4f6a114d81fb5b2f73bb65a1f1cc3c21fe64fa0c;hb=be471d158e4951f4b17335b0fc9ae2387a786b5b)))
+- base, dev: libselinux ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: libsepol ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: liburing ([2.9](https://github.com/axboe/liburing/releases/tag/liburing-2.9) (includes [2.8](https://github.com/axboe/liburing/releases/tag/liburing-2.8)))
+- base, dev: libusb ([1.0.28](https://github.com/libusb/libusb/blob/v1.0.28/ChangeLog))
+- base, dev: libuv ([1.51.0](https://github.com/libuv/libuv/releases/tag/v1.51.0))
+- base, dev: libxml2 ([2.13.8](https://gitlab.gnome.org/GNOME/libxml2/-/releases/v2.13.8))
+- base, dev: openssh ([10.0_p1](https://www.openssh.com/releasenotes.html#10.0p1))
+- base, dev: quota ([4.10](https://sourceforge.net/p/linuxquota/news/2025/04/quota-tools-410-released/))
+- base, dev: semodule-utils ([3.8.1](https://github.com/SELinuxProject/selinux/releases/tag/3.8.1) (includes [3.8](https://github.com/SELinuxProject/selinux/releases/tag/3.8)))
+- base, dev: sqlite ([3.49.2](https://sqlite.org/releaselog/3_49_2.html))
+- base, dev: userspace-rcu ([0.15.2](https://lwn.net/Articles/1017443/))
+- base, dev: vim ([9.1.1436](https://github.com/vim/vim/commits/v9.1.1436/))
+- base, dev: xz-utils ([5.8.1](https://github.com/tukaani-project/xz/releases/tag/v5.8.1) (includes [5.8.0](https://github.com/tukaani-project/xz/releases/tag/v5.8.0)))
+- dev: file ([5.46](https://github.com/file/file/blob/FILE5_46/ChangeLog))
+- dev: gdb ([16.2](https://lists.gnu.org/archive/html/info-gnu/2025-02/msg00000.html) (includes [16.1](https://lists.gnu.org/archive/html/info-gnu/2025-01/msg00009.html)))
+- dev: man-db ([2.13.1](https://gitlab.com/man-db/man-db/-/releases/2.13.1))
+- dev: sandbox ([2.46](https://gitweb.gentoo.org/proj/sandbox.git/log/?h=v2.46))
+- dev: smartmontools ([7.5](https://github.com/smartmontools/smartmontools/releases/tag/RELEASE_7_5))
+- sysext-containerd: containerd ([2.0.5](https://github.com/containerd/containerd/releases/tag/v2.0.5))
+- sysext-containerd: runc ([1.2.6](https://github.com/opencontainers/runc/releases/tag/v1.2.6))
+- sysext-incus: cowsql ([1.15.8](https://github.com/cowsql/cowsql/commits/v1.15.8/))
+- sysext-incus: incus ([6.0.4](https://discuss.linuxcontainers.org/t/incus-6-0-4-lts-has-been-released/23391))
+- sysext-incus: lxc ([6.0.4](https://discuss.linuxcontainers.org/t/lxc-6-0-4-lts-has-been-released/23390))
+- sysext-incus: lxcfs ([6.0.4](https://discuss.linuxcontainers.org/t/lxcfs-6-0-4-lts-has-been-released/23389))
+- sysext-podman: gpgme ([1.24.3](https://dev.gnupg.org/T7659))
+- sysext-python: cachecontrol ([0.14.3](https://github.com/psf/cachecontrol/releases/tag/v0.14.3) (includes [0.14.2](https://github.com/psf/cachecontrol/releases/tag/v0.14.2)))
+- sysext-python: charset-normalizer ([3.4.2](https://github.com/jawah/charset_normalizer/releases/tag/3.4.2))
+- sysext-python: more-itertools ([10.7.0](https://github.com/more-itertools/more-itertools/blob/v10.7.0/docs/versions.rst))
+- sysext-python: packaging ([25.0](https://github.com/pypa/packaging/releases/tag/25.0))
+- sysext-python: pip ([25.1.1](https://github.com/pypa/pip/blob/25.1.1/NEWS.rst) (includes [25.1](https://github.com/pypa/pip/blob/25.1/NEWS.rst)))
+- sysext-python: platformdirs ([4.3.8](https://github.com/tox-dev/platformdirs/releases/tag/4.3.8))
+- sysext-python: requests ([2.32.4](https://github.com/psf/requests/releases/tag/v2.32.4) (includes [2.32.3](https://github.com/psf/requests/releases/tag/v2.32.3)))
+- sysext-python: setuptools ([80.9.0](https://github.com/pypa/setuptools/releases/tag/v80.9.0) (includes [80.8.0](https://github.com/pypa/setuptools/releases/tag/v80.8.0), [80.7.0](https://github.com/pypa/setuptools/releases/tag/v80.7.0), [80.6.0](https://github.com/pypa/setuptools/releases/tag/v80.6.0), [80.4.0](https://github.com/pypa/setuptools/releases/tag/v80.4.0), [80.3.0](https://github.com/pypa/setuptools/releases/tag/v80.3.0), [80.2.0](https://github.com/pypa/setuptools/releases/tag/v80.2.0), [80.1.0](https://github.com/pypa/setuptools/releases/tag/v80.1.0), [80.0.0](https://github.com/pypa/setuptools/releases/tag/v80.0.0), [79.0.0](https://github.com/pypa/setuptools/releases/tag/v79.0.0)))
+- sysext-python: setuptools-scm ([8.3.1](https://github.com/pypa/setuptools-scm/releases/tag/v8.3.1) (includes [8.3.0](https://github.com/pypa/setuptools-scm/releases/tag/v8.3.0)))
+- sysext-python: trove-classifiers ([2025.5.9.12](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.9.12) (includes [2025.5.8.15](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.8.15), [2025.5.8.13](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.8.13), [2025.5.7.19](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.7.19), [2025.5.1.12](https://github.com/pypa/trove-classifiers/releases/tag/2025.5.1.12), [2025.4.28.22](https://github.com/pypa/trove-classifiers/releases/tag/2025.4.28.22)))
+- sysext-zfs: zfs ([2.3.2](https://github.com/openzfs/zfs/releases/tag/zfs-2.3.2))

sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/0001-flatcar-changes.patch

@@ -1,20 +1,21 @@
-From 948c6075656fde25703ba402f8cd94715feaa774 Mon Sep 17 00:00:00 2001
+From 0ed36d7646036e609ab8fba059436f90c4984bbe Mon Sep 17 00:00:00 2001
 From: Krzesimir Nowak <knowak@microsoft.com>
-Date: Mon, 27 Feb 2023 15:59:21 +0100
-Subject: [PATCH] flatcar changes
+Date: Wed, 25 Jun 2025 11:12:00 +0200
+Subject: [PATCH 1/2] flatcar changes
 
 Signed-off-by: Jeremi Piotrowski <jpiotrowski@microsoft.com>
+Signed-off-by: Krzesimir Nowak <knowak@microsoft.com>
 ---
  azurelinuxagent/common/osutil/coreos.py       |  40 +-----
  azurelinuxagent/common/osutil/coreoscommon.py |  59 +++++++++
  azurelinuxagent/common/osutil/factory.py      |   3 +
  azurelinuxagent/common/osutil/flatcar.py      |  78 +++++++++++
- .../common/persist_firewall_rules.py          |   1 +
+ azurelinuxagent/ga/persist_firewall_rules.py  |   2 +-
  config/flatcar/waagent.conf                   | 122 ++++++++++++++++++
  init/flatcar/10-waagent-sysext.conf           |   2 +
  init/flatcar/waagent.service                  |  31 +++++
  setup.py                                      |  20 ++-
- 9 files changed, 313 insertions(+), 43 deletions(-)
+ 9 files changed, 313 insertions(+), 44 deletions(-)
  create mode 100644 azurelinuxagent/common/osutil/coreoscommon.py
  create mode 100644 azurelinuxagent/common/osutil/flatcar.py
  create mode 100644 config/flatcar/waagent.conf
@@ -147,10 +148,10 @@ index 00000000..9008ff20
 +            ["systemctl", "show", "-p", "MainPID", "systemd-networkd"],
 +            transform_command_output=lambda o: o.replace("MainPID=", ""))
 diff --git a/azurelinuxagent/common/osutil/factory.py b/azurelinuxagent/common/osutil/factory.py
-index 83123e3f..b9257a9b 100644
+index fd66fbb0..2c9d2149 100644
 --- a/azurelinuxagent/common/osutil/factory.py
 +++ b/azurelinuxagent/common/osutil/factory.py
-@@ -28,6 +28,7 @@ from .coreos import CoreOSUtil
+@@ -27,6 +27,7 @@ from .coreos import CoreOSUtil
  from .debian import DebianOSBaseUtil, DebianOSModernUtil
  from .default import DefaultOSUtil
  from .devuan import DevuanOSUtil
@@ -158,7 +159,7 @@ index 83123e3f..b9257a9b 100644
  from .freebsd import FreeBSDOSUtil
  from .gaia import GaiaOSUtil
  from .iosxe import IosxeOSUtil
-@@ -88,6 +89,8 @@ def _get_osutil(distro_name, distro_code_name, distro_version, distro_full_name)
+@@ -86,6 +87,8 @@ def _get_osutil(distro_name, distro_code_name, distro_version, distro_full_name)
          return DebianOSBaseUtil()
  
      if distro_name in ("flatcar", "coreos") or distro_code_name in ("flatcar", "coreos"):
@@ -166,7 +167,7 @@ index 83123e3f..b9257a9b 100644
 +            return FlatcarUtil()
          return CoreOSUtil()
  
-     if distro_name in ("suse", "sle_hpc", "sles", "opensuse"):
+     if distro_name in ("suse", "sle-micro", "sle_hpc", "sles", "opensuse"):
 diff --git a/azurelinuxagent/common/osutil/flatcar.py b/azurelinuxagent/common/osutil/flatcar.py
 new file mode 100644
 index 00000000..eeaf25ce
@@ -252,7 +253,7 @@ index 00000000..eeaf25ce
 +            else:
 +                logger.warn("exceeded restart retries")
 diff --git a/azurelinuxagent/ga/persist_firewall_rules.py b/azurelinuxagent/ga/persist_firewall_rules.py
-index 74b878ce..22562c96 100644
+index e7c8373e..d93c984f 100644
 --- a/azurelinuxagent/ga/persist_firewall_rules.py
 +++ b/azurelinuxagent/ga/persist_firewall_rules.py
 @@ -35,7 +35,7 @@ class PersistFirewallRulesHandler(object):
@@ -438,7 +439,7 @@ index 00000000..8d2c1f09
 +[Install]
 +WantedBy=multi-user.target
 diff --git a/setup.py b/setup.py
-index 8f5d92b4..35400e09 100755
+index e83f5989..a94e163c 100755
 --- a/setup.py
 +++ b/setup.py
 @@ -135,12 +135,22 @@ def get_data_files(name, version, fullname):  # pylint: disable=R0912
@@ -470,5 +471,5 @@ index 8f5d92b4..35400e09 100755
          set_bin_files(data_files, dest=agent_bin_path)
          set_conf_files(data_files, dest="/usr/share/defaults/waagent",
 -- 
-2.45.0
+2.49.0
 

sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/files/0002-prevent-ssh-public-key-override.patch

@@ -1,18 +1,17 @@
-From 0c8db73c3567039e50ffa7447bb093ca812dedf6 Mon Sep 17 00:00:00 2001
-Message-Id: <0c8db73c3567039e50ffa7447bb093ca812dedf6.1740577844.git.dpark@linux.microsoft.com>
+From 29e2080e75586df18045e84d02853816cb2f943d Mon Sep 17 00:00:00 2001
 From: Peyton Robertson <93797227+peytonr18@users.noreply.github.com>
 Date: Tue, 28 Jan 2025 14:17:43 -0800
-Subject: [PATCH] Applying patch to prevent ssh public key override (#3309)
+Subject: [PATCH 2/2] Applying patch to prevent ssh public key override (#3309)
 
 ---
  azurelinuxagent/common/osutil/default.py | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/azurelinuxagent/common/osutil/default.py b/azurelinuxagent/common/osutil/default.py
-index 584515dc..746c4363 100644
+index 0a0fd0e1..994edff7 100644
 --- a/azurelinuxagent/common/osutil/default.py
 +++ b/azurelinuxagent/common/osutil/default.py
-@@ -346,7 +346,7 @@ GEN2_DEVICE_ID = 'f8b3781a-1e82-4818-a1c3-63d806ec15bb'
+@@ -557,7 +557,7 @@ class DefaultOSUtil(object):
                  raise OSUtilError("Bad public key: {0}".format(value))
              if not value.endswith("\n"):
                  value += "\n"
@@ -22,5 +21,5 @@ index 584515dc..746c4363 100644
              lib_dir = conf.get_lib_dir()
              crt_path = os.path.join(lib_dir, thumbprint + '.crt')
 -- 
-2.39.5
+2.49.0
 

sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.12.0.4-r1.ebuild

@@ -1,34 +0,0 @@
-# Copyright (c) 2014 CoreOS, Inc.. All rights reserved.
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Don't use DISTUTILS_USE_PEP517=setuptools because this installs
-# everything inside /usr/lib/pythonX_Y/site-packages, even files that
-# ought to be put into /etc or /sbin.
-PYTHON_COMPAT=( python3_{9..11} )
-
-inherit distutils-r1
-
-DESCRIPTION="Windows Azure Linux Agent"
-HOMEPAGE="https://github.com/Azure/WALinuxAgent"
-SRC_URI="${HOMEPAGE}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
-
-LICENSE="Apache-2.0"
-KEYWORDS="amd64 arm64"
-SLOT="0"
-IUSE=""
-RESTRICT=""
-
-BDEPEND="
-	dev-python/distro
-"
-RDEPEND="${BDEPEND}
-"
-
-S="${WORKDIR}/WALinuxAgent-${PV}"
-
-PATCHES=(
-    "${FILESDIR}/0001-flatcar-changes.patch"
-    "${FILESDIR}/0002-prevent-ssh-public-key-override.patch"
-)

sdk_container/src/third_party/coreos-overlay/app-emulation/wa-linux-agent/wa-linux-agent-2.12.0.4-r2.ebuild

@@ -0,0 +1,42 @@
+# Copyright (c) 2014 CoreOS, Inc.. All rights reserved.
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+PYTHON_COMPAT=( python3_{11..13} )
+DISTUTILS_USE_PEP517=setuptools
+
+inherit distutils-r1
+
+DESCRIPTION="Windows Azure Linux Agent"
+HOMEPAGE="https://github.com/Azure/WALinuxAgent"
+SRC_URI="${HOMEPAGE}/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+KEYWORDS="amd64 arm64"
+SLOT="0"
+IUSE=""
+RESTRICT=""
+
+BDEPEND="
+	dev-python/distro
+"
+RDEPEND="${BDEPEND}
+"
+
+S="${WORKDIR}/WALinuxAgent-${PV}"
+
+PATCHES=(
+	"${FILESDIR}/0001-flatcar-changes.patch"
+	"${FILESDIR}/0002-prevent-ssh-public-key-override.patch"
+)
+
+# All the stuff is installed inside the site-packages directory, even executables that ought to be in /sbin or config that ought to be in /etc. Move them.
+python_install() {
+	distutils-r1_python_install
+	local d
+	for d in /etc /usr; do
+		cp -a "${ED}$(python_get_sitedir)${d}" "${ED}" || die
+		rm -rf "${ED}$(python_get_sitedir)${d}" || die
+	done
+}

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/0001-fix-build-with-curl-8-13-0.patch

@@ -1,36 +0,0 @@
-https://bugs.gentoo.org/953060
-https://gitlab.kitware.com/cmake/cmake/-/issues/26754
-https://gitlab.kitware.com/cmake/cmake/-/merge_requests/10449
-
-From 1b0c92a3a1b782ff3e1c4499b6ab8db614d45bcd Mon Sep 17 00:00:00 2001
-From: Brad King <brad.king@kitware.com>
-Date: Mon, 10 Mar 2025 11:08:42 -0400
-Subject: [PATCH] cmCurl: Avoid using undocumented type for CURLOPT_NETRC
- values
-
-Since upstream curl commit `2ec00372a1` (curl.h: change some enums to
-defines with L suffix, 2025-02-25), the `CURL_NETRC_*` constants are
-integer literals instead of `enum CURL_NETRC_OPTION`.  It turns out
-that `curl_easy_setopt` has always expected a `long` anyway, and
-that `CURL_NETRC_OPTION` is not documented for public use.
-
-Fixes: #26754
----
- Source/cmCurl.cxx | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/Source/cmCurl.cxx b/Source/cmCurl.cxx
-index b9133ed7d47..0cf8a71a72d 100644
---- a/Source/cmCurl.cxx
-+++ b/Source/cmCurl.cxx
-@@ -170,7 +170,7 @@ std::string cmCurlSetNETRCOption(::CURL* curl, const std::string& netrc_level,
-                                  const std::string& netrc_file)
- {
-   std::string e;
--  CURL_NETRC_OPTION curl_netrc_level = CURL_NETRC_LAST;
-+  long curl_netrc_level = CURL_NETRC_LAST;
-   ::CURLcode res;
- 
-   if (!netrc_level.empty()) {
--- 
-GitLab

sdk_container/src/third_party/coreos-overlay/coreos/user-patches/dev-build/cmake/README.md

@@ -1,3 +0,0 @@
-The `0001-fix-build-with-curl-8-13-0.patch` was taken from Gentoo -
-the patched cmake is 3.31.6-r1, so if we get updated to that version
-or later, we can drop the patch.

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.accept_keywords

@@ -7,8 +7,8 @@
 # Gentoo upstream package stabilisation
 # (the following packages are "unstable" upstream; we're stabilising these)
 
-# Needed to address CVE-2024-40635.
-=app-containers/containerd-2.0.4 ~amd64 ~arm64
+# Needed to address CVE-2024-40635, CVE-2025-47291
+=app-containers/containerd-2.0.5 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =app-containers/cri-tools-1.32.0 ~arm64
@@ -17,8 +17,11 @@
 =app-containers/crun-1.20 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
-=app-containers/lxc-6.0.3 ~arm64
-=app-containers/incus-6.0.3-r2 ~arm64
+=app-containers/lxc-6.0.4-r1 ~amd64 ~arm64
+=app-containers/incus-6.0.4-r1 ~amd64 ~arm64
+
+# Needed by app-containers/containerd-2.0.5
+=app-containers/runc-1.2.6 ~amd64 ~arm64
 
 # No stable keywords.
 =app-containers/syft-1.18.1 ~amd64 ~arm64
@@ -32,20 +35,32 @@
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =app-crypt/clevis-19-r1 **
 
+# Needed to address CVE-2025-1215, CVE-2025-22134, CVE-2025-24014, GHSA-63p5-mwg2-787v, CVE-2025-27423, CVE-2025-29768
+=app-editors/vim-9.1.1436 ~amd64 ~arm64
+=app-editors/vim-core-9.1.1436 ~amd64 ~arm64
+
 # Needed by arm64-native SDK.
 =app-emulation/open-vmdk-1.0 *
 
 # Keep versions on both arches in sync.
 =app-emulation/qemu-guest-agent-9.2.0 ~arm64
 
-# Needed to address CVE-2025-22871, bring in a patch disabling gold linker on
-# arm64, and fix a segfault concerning vgetrandom.
-=dev-lang/go-1.24.2-r2 ~amd64 ~arm64
+# Needed to address CVE-2024-23337, CVE-2024-53427, CVE-2025-48060
+=app-misc/jq-1.8.0 ~amd64 ~arm64
+
+# Keep versions on both arches in sync.
+=dev-build/meson-1.7.2 ~arm64
+=dev-db/sqlite-3.49.2 ~arm64
+=dev-lang/go-1.24.4 ~arm64
 
 # Keep versions on both arches in sync.
 =dev-lang/yasm-1.3.0-r1 ~arm64
 =dev-libs/ding-libs-0.6.2-r1 ~arm64
-=dev-libs/cowsql-1.15.7 ~arm64
+=dev-libs/cowsql-1.15.8 ~arm64
+
+# Needed to address CVE-2025-4373
+=dev-libs/glib-2.84.3 ~amd64 ~arm64
+=dev-libs/gobject-introspection-common-1.84.0 ~amd64 ~arm64
 
 # The only available ebuild (from GURU) has ~amd64 and no keyword for arm64 yet.
 =dev-libs/jose-12 **
@@ -60,11 +75,15 @@
 # Catalyst 4 is not stable yet, but earlier versions are masked now.
 =dev-util/catalyst-4.0.0 ~amd64 ~arm64
 
+# Needed to address CVE-2025-4373
+=dev-util/glib-utils-2.84.3 ~amd64 ~arm64
+=dev-util/gdbus-codegen-2.84.3 ~amd64 ~arm64
+
 # Keep versions on both arches in sync.
 =dev-util/xdelta-3.0.11-r1 ~arm64
 
-# Needed to address CVE-2025-31498.
-=net-dns/c-ares-1.34.5 ~amd64 ~arm64
+# Needed to address CVE-2024-11187, CVE-2024-12705
+=net-dns/bind-9.18.37-r1 ~amd64 ~arm64
 
 # Keep versions on both arches in sync.
 =net-firewall/conntrack-tools-1.4.8-r1 ~arm64
@@ -76,11 +95,8 @@
 =net-libs/libnetfilter_cthelper-1.0.1-r1 ~arm64
 =net-libs/libnetfilter_cttimeout-1.0.1 ~arm64
 
-# Needed to address curl-20250205 (https://github.com/curl/curl/issues/16197)
-=net-misc/curl-8.13.0-r1 ~amd64 ~arm64
-
-# Needed to address CVE-2024-53580.
-=net-misc/iperf-3.18 ~amd64 ~arm64
+# Needed for addressing CVE-2025-47268 and CVE-2025-48964
+=net-misc/iputils-20250605 ~amd64 ~arm64
 
 # Packages are in Gentoo but not expected to be used outside Flatcar, so they
 # are generally never stabilised. Thus an unusual form is used to pick up the
@@ -93,9 +109,6 @@ dev-cpp/azure-security-keyvault-keys
 sys-apps/azure-vm-utils
 
 # Keep versions on both arches in sync.
-=sys-apps/policycoreutils-3.7 ~arm64
-=sys-apps/semodule-utils-3.7 ~arm64
-=sys-apps/util-linux-2.40.4 ~arm64
 =sys-apps/zram-generator-1.2.1 ~arm64
 =sys-auth/polkit-126-r1 ~amd64
 
@@ -110,6 +123,5 @@ sys-apps/azure-vm-utils
 
 # Keep versions on both arches in sync.
 =sys-fs/fuse-3.17.2 ~arm64
-=sys-fs/lxcfs-6.0.3-r1 ~arm64
-=sys-libs/libsemanage-3.7 ~arm64
+=sys-fs/lxcfs-6.0.4 ~arm64
 =sys-process/audit-4.0.2-r1 ~arm64

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.mask

@@ -20,3 +20,8 @@
 
 # Pulls in LLVM and clang.
 >=sys-block/thin-provisioning-tools-1.0.14
+
+# Too large to fit into our /boot partition - the size grew by 3MB. We
+mask a specific version in hope that the future update may be smaller,
+who knows.
+=sys-firmware/intel-microcode-20250512_p20250513

sdk_container/src/third_party/coreos-overlay/profiles/coreos/base/package.use

@@ -8,7 +8,7 @@ app-crypt/mit-krb5	-keyutils
 dev-libs/dbus-glib	tools
 dev-libs/libxml2	-python
 dev-libs/libxslt	-python
-dev-util/perf		-doc
+dev-util/perf		-doc -slang
 dev-vcs/git		webdav curl
 
 # Mask support for http3 for now (unavailable on arm64 for now, and
@@ -193,3 +193,6 @@ dev-util/xdelta lzma
 # required by app-containers/incus-6.0.3-r1::portage-stable
 # required by incus (argument)
 sys-libs/libcap static-libs
+
+# do not force a dependency on llvm-core/llvm yet
+dev-lang/rust -system-llvm

sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/Manifest

@@ -1,2 +1,2 @@
-DIST policycoreutils-3.7.tar.gz 757142 BLAKE2B 95794d48ef80882803199af5330f0ac4f1cee6710562a559e3d8fd94475d117286f8b612ffc5dc9027f4f8f4cd55e82ddb4d328e91d6c9846b18460c9bee159b SHA512 30e3413b15df0bf1a994d2b3a03a719f89b3ee521a708b92fcc684822152145722cb3ef28fd5b7c42b779281b0bd4d69d65c0bc2605eec1af3f388609d985500
+DIST policycoreutils-3.8.1.tar.gz 758726 BLAKE2B cda4c6a967a156874d6adcadbda546d8cf30d19622e0bec85ade88eccf730e4dd143eb7b07678826e1284aaa2fe316c24f828d28f422e15694d38d4e06035b78 SHA512 e14df87d163eec46a57bb7496db77090bd310554b2af1b68c66d9ef2f160bc4ac17305fb889a5415489baeabfd47946c0e37e6ad4dd14e392529c802ad06290b
 DIST policycoreutils-extra-1.37.tar.bz2 8809 BLAKE2B a7f6122c2e27f54b018174e962bd7f4c14af04e09bbb5300bde6967ea7f2dc5cd03b5787919a4e7f5288bcbc6747922962b5bd3b588ab1e3a035fbff4910d8f5 SHA512 0a85cd7cf279256b5e1927f9dfdd89626a1c8b77b0aeb62b496e7e8d1dccbaa315e39f9308fb2df7270f0bc1c10787b19990e7365cad74b47b61e30394c8b23f

sdk_container/src/third_party/coreos-overlay/sys-apps/policycoreutils/policycoreutils-3.8.1.ebuild

@@ -2,7 +2,7 @@
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 PYTHON_REQ_USE="xml(+)"
 
 inherit python-r1 toolchain-funcs bash-completion-r1
@@ -24,7 +24,7 @@ if [[ ${PV} == 9999 ]]; then
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz
 		!vanilla? ( https://dev.gentoo.org/~perfinion/distfiles/policycoreutils-extra-${EXTRAS_VER}.tar.bz2 )"
-	KEYWORDS="amd64 ~arm ~arm64 ~riscv x86"
+	KEYWORDS="amd64 arm arm64 x86"
 	S1="${WORKDIR}/${MY_P}"
 	S2="${WORKDIR}/policycoreutils-extra"
 	S="${S1}"

sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/Manifest

@@ -1 +1 @@
-DIST libsemanage-3.7.tar.gz 182896 BLAKE2B e8a4a9a57f1862efac7e46b33f34f2fdcd116a14487ca07f65aebed62b3914bb1892606a76ed8addcbdb111f361507294ae3c75975a10b90f5d554ba59d2562d SHA512 4b6370b02116364964ff24b93fb6629c885611de78419f649a027db38b4f1c3b3adf3b438efb34a92b49407ab8f9446ed4091fe4c99fa4752f0f5e3e31589415
+DIST libsemanage-3.8.1.tar.gz 184618 BLAKE2B 25816a0dccc9cb4fe2033e548e0e840b5ffbde3771a8a4f6d81223c7c29e3622eb0152050d8f1ba41bd6b9afb0ad9819e9a1fabd9722e01cad57d7fd7a135d5d SHA512 ac3729ba4934a48a33e082af35baa9e25e6806855afb0f0e4e22aa67be201518c3d4933b8cf4dec83e5acbe178301276f51850bb1b16bc13e027a470ac7f1eb5

sdk_container/src/third_party/coreos-overlay/sys-libs/libsemanage/libsemanage-3.8.1.ebuild

@@ -2,7 +2,7 @@
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI="8"
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..13} )
 
 inherit python-r1 toolchain-funcs multilib-minimal
 
@@ -18,7 +18,7 @@ if [[ ${PV} == 9999 ]]; then
 	S="${WORKDIR}/${P}/${PN}"
 else
 	SRC_URI="https://github.com/SELinuxProject/selinux/releases/download/${MY_PV}/${MY_P}.tar.gz"
-	KEYWORDS="amd64 ~arm ~arm64 ~mips ~riscv x86"
+	KEYWORDS="amd64 arm arm64 ~mips ~riscv x86"
 	S="${WORKDIR}/${MY_P}"
 fi
 

sdk_container/src/third_party/portage-stable/app-admin/eselect/eselect-1.4.30.ebuild

@@ -16,7 +16,7 @@ SRC_URI="https://dev.gentoo.org/~ulm/eselect/${P}.tar.xz"
 
 LICENSE="GPL-2+ || ( GPL-2+ CC-BY-SA-4.0 )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="doc emacs vim-syntax"
 
 # coreutils for realpath

sdk_container/src/third_party/portage-stable/app-arch/gzip/gzip-1.14.ebuild

@@ -31,7 +31,7 @@ fi
 LICENSE="GPL-3+"
 SLOT="0"
 if [[ ${PV} != *_p* ]] ; then
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 IUSE="pic static"
 

sdk_container/src/third_party/portage-stable/app-arch/libarchive/Manifest

@@ -1,2 +1,6 @@
 DIST libarchive-3.7.9.tar.xz 5494688 BLAKE2B 7bcfb3fe8ffd9452f3d71cdc738144069594030278572ebba0bb247ad74fd68ec19822f281364878228ee311976e216614d4764e56c5fb7f98801695ab7aa7f4 SHA512 d8918445e2536eb29c2d6a6c8cd3671a8525be1619009a2e7c3a9c2a821b51939172dfccc25bfd62fec2a17fb01796b4f522b0ba72b31e3de9b9658c44c46345
 DIST libarchive-3.7.9.tar.xz.asc 659 BLAKE2B 1de2d5af2422c8220983d7e5aa76fae1fcf12c008e7a99ec193b82145a03506fddabc7d5b89efce609e3b807511ebf719fce2f81f2150ccc0a57b4248ad3c5cb SHA512 e60bf9b6c8c58a6fd8977df0ccdd375e42db03f99623412897711dfcbfa4fb4a5b8707e8643c30e25e8b2946df58d1367f67c6ef99223a2739dabbce387f83c5
+DIST libarchive-3.8.0.tar.xz 5950876 BLAKE2B 7cdccd6b4cbb180dbd40fba3461fa98b53aaf05c0b4b71776d9bb26d1ed5329b8aff9cb534667334a4069bb6e1e629522b048ce859c408d48ba96cec9c41bddf SHA512 b0dcee8cb586ce2061987589067bbc063e326471fe36de64cc9c3e8b5eaaaedb85ef2b320be1671e008a32f39bdfc07db4e8abbde58328ab2655c2af0f0984f9
+DIST libarchive-3.8.0.tar.xz.asc 659 BLAKE2B 47893aa0770487b7f3902ae9950baec3cecf7d514ead57d83e2d0cd6feb2e96c55fe1a42020a70260d6958eee654633f01b1dd200b2ef718248d2c559905ad37 SHA512 62896d1995b9d05dc0d01829062fa954c1319764a7b7d1dc34cde456b303c115725921dbcfa3dd82384aa8f81df9c9b04abcf9fafa1457d31e581da7b7b2f642
+DIST libarchive-3.8.1.tar.xz 5950428 BLAKE2B 92ce11758ea050c7f5b3b2440566b71d29d4fe3ee90ee3455117585ef629eb7cfbe6f3c67bfb309c38d02118ef8f71c1c30ffe14466bfef7929c6d6134b11fc8 SHA512 c794d1c6e6a6dcf4072438dc4e8ce5b1530bbe9ad40afad18f4e6a444aa5d85e48c58cfbd8af41d4d25e93844956de3ce262cb1d68097d2e5f95bd87b5a982b7
+DIST libarchive-3.8.1.tar.xz.asc 659 BLAKE2B 0965437c5087b29c356280613fba546c0f08cbe3996c885957e1424304f3ea1cb4651168b34c3389ec6119bd5ab99160dc530dced31490cd2f6e8c3850e77223 SHA512 540ea8203920c1e8e6934f20c0f6b592a309c82f82561960d9adff3a3a09cf28c7a3d92070682b6b420ef82c6e30d6e9741d8c3e5473a78390da5137e61c05bd

sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.0.ebuild

@@ -0,0 +1,173 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}

sdk_container/src/third_party/portage-stable/app-arch/libarchive/libarchive-3.8.1.ebuild

@@ -0,0 +1,174 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit libtool multilib-minimal toolchain-funcs verify-sig
+
+DESCRIPTION="Multi-format archive and compression library"
+HOMEPAGE="
+	https://www.libarchive.org/
+	https://github.com/libarchive/libarchive/
+"
+SRC_URI="
+	https://www.libarchive.de/downloads/${P}.tar.xz
+	verify-sig? ( https://www.libarchive.de/downloads/${P}.tar.xz.asc )
+"
+
+LICENSE="BSD BSD-2 BSD-4 public-domain"
+SLOT="0/13"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="
+	acl blake2 +bzip2 +e2fsprogs expat +iconv lz4 +lzma lzo nettle
+	static-libs test xattr +zstd
+"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	sys-libs/zlib:=[${MULTILIB_USEDEP}]
+	acl? ( virtual/acl:=[${MULTILIB_USEDEP}] )
+	blake2? ( app-crypt/libb2:=[${MULTILIB_USEDEP}] )
+	bzip2? ( app-arch/bzip2:=[${MULTILIB_USEDEP}] )
+	expat? ( dev-libs/expat:=[${MULTILIB_USEDEP}] )
+	!expat? ( dev-libs/libxml2:=[${MULTILIB_USEDEP}] )
+	iconv? ( virtual/libiconv:=[${MULTILIB_USEDEP}] )
+	dev-libs/openssl:=[${MULTILIB_USEDEP}]
+	lz4? ( >=app-arch/lz4-0_p131:=[${MULTILIB_USEDEP}] )
+	lzma? ( >=app-arch/xz-utils-5.2.5-r1:=[${MULTILIB_USEDEP}] )
+	lzo? ( >=dev-libs/lzo-2:=[${MULTILIB_USEDEP}] )
+	nettle? ( dev-libs/nettle:=[${MULTILIB_USEDEP}] )
+	zstd? ( app-arch/zstd:=[${MULTILIB_USEDEP}] )
+"
+DEPEND="${RDEPEND}
+	kernel_linux? (
+		virtual/os-headers
+		e2fsprogs? ( sys-fs/e2fsprogs[${MULTILIB_USEDEP}] )
+	)
+	test? (
+		app-arch/lrzip
+		app-arch/lz4
+		app-arch/lzip
+		app-arch/lzop
+		app-arch/xz-utils
+		app-arch/zstd
+		lzma? ( app-arch/xz-utils[extra-filters(+)] )
+	)
+"
+BDEPEND="
+	virtual/pkgconfig
+	verify-sig? ( >=sec-keys/openpgp-keys-libarchive-20221209 )
+	elibc_musl? ( sys-libs/queue-standalone )
+"
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/libarchive.org.asc
+
+# false positives (checks for libc-defined hash functions)
+QA_CONFIG_IMPL_DECL_SKIP=(
+	SHA256_Init SHA256_Update SHA256_Final
+	SHA384_Init SHA384_Update SHA384_Final
+	SHA512_Init SHA512_Update SHA512_Final
+)
+
+PATCHES=(
+	# https://github.com/libarchive/libarchive/issues/2069
+	# (we can simply update the command since we don't support old lrzip)
+	"${FILESDIR}/${PN}-3.7.2-lrzip.patch"
+)
+
+src_prepare() {
+	default
+
+	# Needed for flags to be respected w/ LTO
+	elibtoolize
+}
+
+multilib_src_configure() {
+	export ac_cv_header_ext2fs_ext2_fs_h=$(usex e2fsprogs) #354923
+
+	local myconf=(
+		$(use_enable acl)
+		$(use_enable static-libs static)
+		$(use_enable xattr)
+		$(use_with blake2 libb2)
+		$(use_with bzip2 bz2lib)
+		$(use_with expat)
+		$(use_with !expat xml2)
+		$(use_with iconv)
+		$(use_with lz4)
+		$(use_with lzma)
+		$(use_with lzo lzo2)
+		$(use_with nettle)
+		--with-zlib
+		$(use_with zstd)
+
+		# Windows-specific
+		--without-cng
+	)
+	if multilib_is_native_abi ; then
+		myconf+=(
+			--enable-bsdcat="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdcpio="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdtar="$(tc-is-static-only && echo static || echo shared)"
+			--enable-bsdunzip="$(tc-is-static-only && echo static || echo shared)"
+		)
+	else
+		myconf+=(
+			--disable-bsdcat
+			--disable-bsdcpio
+			--disable-bsdtar
+			--disable-bsdunzip
+		)
+	fi
+
+	ECONF_SOURCE="${S}" econf "${myconf[@]}"
+}
+
+multilib_src_compile() {
+	if multilib_is_native_abi ; then
+		emake
+	else
+		emake libarchive.la
+	fi
+}
+
+src_test() {
+	mkdir -p "${T}"/bin || die
+	# tests fail when lbzip2[symlink] is used in place of ref bunzip2
+	ln -s "${BROOT}/bin/bunzip2" "${T}"/bin || die
+	# workaround lrzip broken on 32-bit arches with >= 10 threads
+	# https://bugs.gentoo.org/927766
+	cat > "${T}"/bin/lrzip <<-EOF || die
+		#!/bin/sh
+		exec "$(type -P lrzip)" -p1 "\${@}"
+	EOF
+	chmod +x "${T}/bin/lrzip" || die
+	local -x PATH=${T}/bin:${PATH}
+	multilib-minimal_src_test
+}
+
+multilib_src_test() {
+	# sandbox is breaking long symlink behavior
+	local -x SANDBOX_ON=0
+	local -x LD_PRELOAD=
+	# some locales trigger different output that breaks tests
+	local -x LC_ALL=C.UTF-8
+	emake check
+}
+
+multilib_src_install() {
+	if multilib_is_native_abi ; then
+		emake DESTDIR="${D}" install
+	else
+		local install_targets=(
+			install-includeHEADERS
+			install-libLTLIBRARIES
+			install-pkgconfigDATA
+		)
+		emake DESTDIR="${D}" "${install_targets[@]}"
+	fi
+
+	# Libs.private: should be used from libarchive.pc instead
+	find "${ED}" -type f -name "*.la" -delete || die
+	# https://github.com/libarchive/libarchive/issues/1766
+	sed -e '/Requires\.private/s:iconv::' \
+		-i "${ED}/usr/$(get_libdir)/pkgconfig/libarchive.pc" || die
+}

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.6.4-r2.ebuild

@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -71,6 +71,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -113,8 +118,11 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
@@ -189,6 +197,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-5.8.1-r1.ebuild

@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -35,7 +35,7 @@ else
 	"
 
 	if [[ ${PV} != *_alpha* && ${PV} != *_beta* ]] ; then
-		KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+		KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 	fi
 
 	S="${WORKDIR}/${MY_P}"
@@ -65,6 +65,16 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+
+	if tc-ld-is-lld ; then
+		export LDFLAGS="${LDFLAGS} -Wl,--undefined-version"
+	fi
+
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -107,8 +117,11 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
@@ -183,6 +196,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then

sdk_container/src/third_party/portage-stable/app-arch/xz-utils/xz-utils-9999.ebuild

@@ -6,7 +6,7 @@
 
 EAPI=8
 
-inherit libtool multilib multilib-minimal preserve-libs toolchain-funcs
+inherit dot-a flag-o-matic libtool multilib multilib-minimal preserve-libs toolchain-funcs
 
 if [[ ${PV} == 9999 ]] ; then
 	# Per tukaani.org, git.tukaani.org is a mirror of github and
@@ -65,6 +65,11 @@ src_prepare() {
 	fi
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local myconf=(
 		--enable-threads
@@ -107,8 +112,11 @@ multilib_src_configure() {
 }
 
 multilib_src_compile() {
-	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo")
-	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo")
+	# -fprofile-partial-training because upstream note the test suite isn't super comprehensive
+	# TODO: revisit that now we have the tar/xz loop below?
+	# See https://documentation.suse.com/sbp/all/html/SBP-GCC-10/index.html#sec-gcc10-pgo
+	local pgo_generate_flags=$(usev pgo "-fprofile-update=atomic -fprofile-dir=${T}/${ABI}-pgo -fprofile-generate=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
+	local pgo_use_flags=$(usev pgo "-fprofile-use=${T}/${ABI}-pgo -fprofile-dir=${T}/${ABI}-pgo $(test-flags-CC -fprofile-partial-training)")
 
 	emake CFLAGS="${CFLAGS} ${pgo_generate_flags}"
 
@@ -183,6 +191,8 @@ multilib_src_install() {
 }
 
 multilib_src_install_all() {
+	strip-lto-bytecode
+
 	find "${ED}" -type f -name '*.la' -delete || die
 
 	if use doc ; then

sdk_container/src/third_party/portage-stable/app-arch/zstd/Manifest

@@ -1,2 +1 @@
-DIST zstd-1.5.6.tar.gz 2406875 BLAKE2B fe17cf0950f8ee2cc07bfa2b41e97f36a1832e396386cb94a55bede975dc974920578cf147b39eecbc5b53ff06fe0dc1fe781a4cab9bc9f767ea28c0e786422e SHA512 54a578f2484da0520a6e9a24f501b9540a3fe3806785d6bc9db79fc095b7c142a7c121387c7eecd460ca71446603584ef1ba4d29a33ca90873338c9ffbd04f14
 DIST zstd-1.5.7.tar.gz 2434947 BLAKE2B ef6bcf13bbb79edce2de21ef4860b01dcb4d2dd47ebd03657d5331c3bb1a207ef128e99ed907a32e787dca7bb51df225ebd8abb2097d03d02c003ca713e1e271 SHA512 b4de208f179b68d4c6454139ca60d66ed3ef3893a560d6159a056640f83d3ee67cdf6ffb88971cdba35449dba4b597eaa8b4ae908127ef7fd58c89f40bf9a705

sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.6.ebuild

@@ -1,79 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-inherit flag-o-matic meson-multilib
-
-DESCRIPTION="zstd fast compression library"
-HOMEPAGE="https://facebook.github.io/zstd/"
-SRC_URI="https://github.com/facebook/zstd/releases/download/v${PV}/${P}.tar.gz"
-S="${WORKDIR}"/${P}/build/meson
-
-LICENSE="|| ( BSD GPL-2 )"
-SLOT="0/1"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-IUSE="+lzma lz4 static-libs test zlib"
-RESTRICT="!test? ( test )"
-
-RDEPEND="
-	lzma? ( app-arch/xz-utils )
-	lz4? ( app-arch/lz4:= )
-	zlib? ( sys-libs/zlib )
-"
-DEPEND="${RDEPEND}"
-
-MESON_PATCHES=(
-	# Workaround until Valgrind bugfix lands
-	"${FILESDIR}"/${PN}-1.5.4-no-find-valgrind.patch
-)
-
-PATCHES=(
-)
-
-src_prepare() {
-	cd "${WORKDIR}"/${P} || die
-	default
-
-	cd "${S}" || die
-	eapply "${MESON_PATCHES[@]}"
-}
-
-multilib_src_configure() {
-	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
-
-	# This replaces the no-find-valgrind patch once bugfix lands in a meson
-	# release + we can BDEPEND on it (https://github.com/mesonbuild/meson/pull/11372)
-	cat >> ${native_file} <<-EOF || die
-	[binaries]
-	valgrind='valgrind-falseified'
-	EOF
-
-	# Test suite validates that stack is not executable.  Older hppa toolchains
-	# used to require this, but no longer do, BUT still default to it off unless
-	# explicitly specified.  See #903923
-	# The cmake build sets these, but the meson build doesn't, so set it manually.
-	# https://github.com/facebook/zstd/blob/979b047/build/cmake/CMakeModules/AddZstdCompilationFlags.cmake#L77-L82
-	append-flags $(test-flags-CCLD "-Wa,--noexecstack")
-	append-ldflags $(test-flags-CCLD "-Wl,-z,noexecstack")
-
-	local emesonargs=(
-		-Ddefault_library=$(multilib_native_usex static-libs both shared)
-
-		$(meson_native_true bin_programs)
-		$(meson_native_true bin_contrib)
-		$(meson_use test bin_tests)
-
-		$(meson_native_use_feature zlib)
-		$(meson_native_use_feature lzma)
-		$(meson_native_use_feature lz4)
-
-		--native-file "${native_file}"
-	)
-
-	meson_src_configure
-}
-
-multilib_src_test() {
-	meson_src_test --timeout-multiplier=2
-}

sdk_container/src/third_party/portage-stable/app-arch/zstd/zstd-1.5.7-r1.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit meson-multilib
+inherit dot-a meson-multilib
 
 DESCRIPTION="zstd fast compression library"
 HOMEPAGE="https://facebook.github.io/zstd/"
@@ -40,6 +40,11 @@ src_prepare() {
 	eapply "${MESON_PATCHES[@]}"
 }
 
+src_configure() {
+	use static-libs && lto-guarantee-fat
+	multilib-minimal_src_configure
+}
+
 multilib_src_configure() {
 	local native_file="${T}"/meson.${CHOST}.${ABI}.ini.local
 
@@ -70,3 +75,8 @@ multilib_src_configure() {
 multilib_src_test() {
 	meson_src_test --timeout-multiplier=2
 }
+
+multilib_src_install_all() {
+	einstalldocs
+	strip-lto-bytecode
+}

sdk_container/src/third_party/portage-stable/app-containers/containerd/Manifest

@@ -2,3 +2,5 @@ DIST containerd-2.0.2.tar.gz 10379986 BLAKE2B aee39f749f056965b899f6525bebe00d46
 DIST containerd-2.0.3.tar.gz 10450757 BLAKE2B 5dec56a40dc2874fb0b6fd4d72704f6417858eefd983c8ec5dfb2c9ef8be1e9e309cff83395e03c2d5fef30ed5c0561329ffbcd3dfba91e40d8017f7a605771b SHA512 9528a65d9d9f13d15d861f7ce71ab483958020bda83947d18868b477204e9e2e33eccc69280502c54b2be9ce577724e3e2b1772229c99636099b04bac1079ac1
 DIST containerd-2.0.4.tar.gz 10450939 BLAKE2B f82ed40eab0f1d186f4fb04217b8f75a9da8e33b1140c0b5866dcc61e17fe1040f31ef09bdb07ad98a52def5e9eb12cfeb635e96b2c5f64fdb4d8cfb6c84b885 SHA512 f84e0cc0b82313df010b95989faf56e81ebfbbc321585b968c8c706917b91a9f0d895692fa5046f24f1c370de7a74b50daf83da617fe0595e5a8ff69ed658727
 DIST containerd-2.0.5.tar.gz 10452563 BLAKE2B bf03316c9211eaa17a3b40b1fc9f9aca42fe3e621e086e612eb07c286c6b62bc7a0a2426ce7b6742dce2924d570ab599aefb43463c4fa6be277e562bad79668f SHA512 af89a5c9ad5f931c5fee33c75c13c296fc9ec966f2c64ec244897695eebb365bcb542f6b431e60d4ef7213f0ea11d3a8896d1b7f033ed445e6b521b7ddbffe6f
+DIST containerd-2.1.0.tar.gz 10610618 BLAKE2B 147c21b4650543af9b0e533e381a0505ba927d6e9270b9b03a09016eb3ccf29875db7fa274944fea2ff7b029b6a05a17d14c61e24b5f3426b31f320831eeb46a SHA512 e9bb128917bb6b2e21a8e05344af3fdcdda8620be20e54407bc2c73046278a88a77bcbed6ef7a59099c9ee3303283db46b90b71afdd45236d3c534749ba844e0
+DIST containerd-2.1.1.tar.gz 10610787 BLAKE2B acc2d769752c783643795d228c0d267b0802e09166dc783e84087da0029a822a64688f5e59c047c47b25f50ca2a1ccb7f5b6216ad6beeb4489df308e525e9716 SHA512 542f7cae61e1ef2e1b529b0bea66d7ad9016d4605de73de9c9c8a738e50ec6f470b939d1546482320515b77424bffe1cf24b721173ac0c0ecd0100c92817cfb1

sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.0.ebuild

@@ -0,0 +1,90 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-module systemd
+GIT_REVISION=061792f0ecf3684fb30a3a0eb006799b8c6638a7
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# race condition in man target https://bugs.gentoo.org/765100
+	# we need to explicitly specify GOFLAGS for "go run" to use vendor source
+	emake "${myemakeargs[@]}" man -j1 #nowarn
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}

sdk_container/src/third_party/portage-stable/app-containers/containerd/containerd-2.1.1.ebuild

@@ -0,0 +1,95 @@
+# Copyright 2022-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+inherit go-env go-module systemd toolchain-funcs
+GIT_REVISION=cb1076646aa3740577fafbf3d914198b7fe8e3f7
+
+DESCRIPTION="A daemon to control runC"
+HOMEPAGE="https://containerd.io/"
+SRC_URI="https://github.com/containerd/containerd/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs device-mapper +cri hardened +seccomp selinux test"
+
+COMMON_DEPEND="
+	btrfs? ( sys-fs/btrfs-progs )
+	seccomp? ( sys-libs/libseccomp )
+"
+
+DEPEND="
+${COMMON_DEPEND}
+"
+
+# recommended minimum version of runc is found in script/setup/runc-version
+RDEPEND="
+	${COMMON_DEPEND}
+	>=app-containers/runc-1.3.0[apparmor?,seccomp?]
+"
+
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+
+# tests require root or docker
+RESTRICT+="test"
+
+src_prepare() {
+	default
+	sed -i \
+		-e "s/-s -w//" \
+		-e "s/-mod=readonly//" \
+		Makefile || die
+	sed -i \
+		-e "s:/usr/local:/usr:" \
+		containerd.service || die
+}
+
+src_compile() {
+	local options=(
+		$(usev apparmor)
+		$(usex btrfs "" "no_btrfs")
+		$(usex cri "" "no_cri")
+		$(usex device-mapper "" "no_devmapper")
+		$(usev seccomp)
+		$(usev selinux)
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')"
+		REVISION="${GIT_REVISION}"
+		VERSION=v${PV}
+	)
+
+	# The Go env is already set, but reset it for CBUILD in a subshell to allow
+	# building the man pages when cross-compiling.
+	(
+		CHOST="${CBUILD}" go-env_set_compile_environment
+		# race condition in man target https://bugs.gentoo.org/765100
+		tc-env_build emake "${myemakeargs[@]}" man -j1 #nowarn
+	)
+
+	emake "${myemakeargs[@]}" all
+
+}
+
+src_install() {
+	rm bin/gen-manpages || die
+	dobin bin/*
+	doman man/*
+	newconfd "${FILESDIR}"/${PN}.confd "${PN}"
+	newinitd "${FILESDIR}"/${PN}.initd "${PN}"
+	systemd_dounit containerd.service
+	keepdir /var/lib/containerd
+
+	# we already installed manpages, remove markdown source
+	# before installing docs directory
+	rm -r docs/man || die
+
+	local DOCS=( ADOPTERS.md README.md RELEASES.md ROADMAP.md SCOPE.md docs/. )
+	einstalldocs
+}

sdk_container/src/third_party/portage-stable/app-containers/cri-tools/Manifest

@@ -1,2 +1,3 @@
 DIST cri-tools-1.27.0.tar.gz 8465050 BLAKE2B d6c0429271ebc4085e75b54d7f3b9f75ab796e63bc9ae7562105296b13bbad8b512293a7d25abf1ab946f4bf54e672016fdb72696c12c730d21ac74724da465c SHA512 b94122e6401eb0c33b9c3d112274b7ab20cbbad05e76a54933e79d2e42ded2d684771cb9ed703a6c1afa381844142b6f1b4dc77d17e915f9a42c236fd8426b9b
 DIST cri-tools-1.32.0.tar.gz 7682096 BLAKE2B 125fc9014942e681353ef49d4d397af4fc77500c0fb37d2d1be0850839c37f51f2ef41b5c7d9ca422e814d1fe50f985bfd42d2bba11d391cea66b3bec381dc08 SHA512 654cfd4d546932d48c02e19071e137fa7565a5134ba1845498d61f2dfef45fca722a51dbadb7a467214f7424290c53cb79a2908684d1fbd3820836b55640f66d
+DIST cri-tools-1.33.0.tar.gz 7754304 BLAKE2B 42011726997a07842fd3c9769335a71e37e1689e443a0d1a99916b5729cc22092593928a6b94bbc3718a0e5f89f3818c3b6d6155970de21e8eee30fc979a294d SHA512 0252243147e32e06328c192f77397461a729aec621bee92083dcf3899e9ffbb62386a944795535cc4a0deb5c88d1017082db8bf221f6627feb7dcd100dc70457

sdk_container/src/third_party/portage-stable/app-containers/cri-tools/cri-tools-1.33.0.ebuild

@@ -0,0 +1,38 @@
+# Copyright 2021-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-env go-module shell-completion toolchain-funcs
+
+DESCRIPTION="CLI and validation tools for Kubelet Container Runtime (CRI)"
+HOMEPAGE="https://github.com/kubernetes-sigs/cri-tools"
+SRC_URI="https://github.com/kubernetes-sigs/cri-tools/archive/v${PV}.tar.gz -> ${P}.tar.gz"
+
+LICENSE="Apache-2.0 BSD BSD-2 CC-BY-SA-4.0 ISC MIT MPL-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm64"
+RESTRICT="test"
+
+DOCS=( docs {README,RELEASE,CHANGELOG,CONTRIBUTING}.md )
+
+src_compile() {
+	local GOOS=$(go-env_goos)
+	CRICTL="build/bin/${GOOS}/${GOARCH}/crictl"
+	emake VERSION="${PV}"
+
+	if ! tc-is-cross-compiler; then
+		"${CRICTL}" completion bash > crictl.bash || die
+		"${CRICTL}" completion zsh > crictl.zsh || die
+	fi
+}
+
+src_install() {
+	einstalldocs
+	dobin "${CRICTL}"
+
+	if ! tc-is-cross-compiler; then
+		newbashcomp crictl.bash crictl
+		newzshcomp crictl.zsh _crictl
+	fi
+}

sdk_container/src/third_party/portage-stable/app-containers/docker-cli/Manifest

@@ -4,3 +4,5 @@ DIST docker-cli-28.0.4-man.tar.xz 70440 BLAKE2B 676eeafda725c759074124e1ccef693d
 DIST docker-cli-28.0.4.tar.gz 7504883 BLAKE2B c975eff2bb4c0dd5430a67418804e8649c733a59ac6b2beb9f2a454a8e8839e12afbf61afccb1e3bd0cb2e38c51fbd59fee3de45490a02ec9ad074cd365ece2c SHA512 fd7562815686fece20a0ea95501612e049e90192305464b06770643ae864baa87b0fb87fddadeb4f9beb33352940cef63ffd24af8b989e309cd5be5f32eddf62
 DIST docker-cli-28.1.1-man.tar.xz 69976 BLAKE2B 497c0874a5ed72c3d2dff6c77b687f012c6a6d4dda67f138e3bf051bf019914efda53d85ffde003e5aea11f849dc199a34b17a1325d439b74e3ccc6f4e324d11 SHA512 06a2e65fe376dcb84474f116f6b2fd04afb6ce5fcd2ed5d3a27e4f7a2f5e849ff0317720936bb75b300ef85eacbf41cd9b9af34345e35c5254ff8c1036e25d7f
 DIST docker-cli-28.1.1.tar.gz 7518124 BLAKE2B 2d9a1b620d4cffa718571cef9aa1825b57600630624715ccdae50a1bbcc44821d599ea2f6e6c66628434740904d53218e101f69b4fd0865b4197ef19d9c2d4fe SHA512 39ff5f982779b70311d4fce5f829e52199b058cedf92c0e650786a52004edbf3935f8673db98527affc57f0e33be435f8a8af624c2e06f28c7f8f405ed570746
+DIST docker-cli-28.2.2-man.tar.xz 69888 BLAKE2B bee8b296ee94c57c34cfa268fde015aff15b6b269905275d47cce73ab94c7bed7edc9ba4d5b9d730dea78d149306736e14186c8a9c782047094511771ec8d105 SHA512 ce608b60915a0b7b15302260ec500b433ba6c9174fa82b34a4ae8ad7bb9d2f6abe45d4e43c0e3978b2f5bb440425e08d416ab9f613cdf64eb6294254765aa37b
+DIST docker-cli-28.2.2.tar.gz 7531638 BLAKE2B cb7d2766e4a6c444169f8462379b8524e0433a29541837c1acbefa62f4b303b6ce1dd629fbb2ed6e154ea51b72ac17c8452284a5e26c9716217e8cbf169374bb SHA512 1ba62398322c65e6994c0c6821b912c9a9b215083593d63557c5255064c407bd25f72044336ebb19977fe6d03215ec47174c6617890a817b9e34ed010535fb6b

sdk_container/src/third_party/portage-stable/app-containers/docker-cli/docker-cli-28.2.2.ebuild

@@ -0,0 +1,74 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit bash-completion-r1 go-module
+MY_PV=${PV/_/-}
+
+# update this on every bump
+GIT_COMMIT=879ac3f88fe137c2058afe995298832eb2ff1546
+
+# To create the man pages tarball, run the following in the git source
+# directory:
+#git checkout ${PV}
+# make manpages
+# tar -acf ${P}-man.tar.xz man/man?
+
+DESCRIPTION="the command line binary for docker"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/docker/cli/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+SRC_URI+=" https://dev.gentoo.org/~williamh/dist/${P}-man.tar.xz"
+S="${WORKDIR}/cli-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc64 ~riscv ~x86"
+IUSE="hardened selinux"
+
+RDEPEND="selinux? ( sec-policy/selinux-docker )"
+
+RESTRICT="installsources strip test"
+
+src_unpack() {
+	default
+	cd "${S}"
+	ln -s vendor.mod go.mod
+	ln -s vendor.sum go.sum
+}
+
+src_prepare() {
+	default
+	sed -i 's@dockerd\?\.exe@@g' contrib/completion/bash/docker || die
+}
+
+src_compile() {
+	export DISABLE_WARN_OUTSIDE_CONTAINER=1
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+		emake \
+		LDFLAGS="$(usex hardened '-extldflags -fno-PIC' '')" \
+		VERSION="${PV}" \
+		GITCOMMIT="${GIT_COMMIT}" \
+		dynbinary
+}
+
+src_install() {
+	dobin build/docker
+	doman "${WORKDIR}"/man/man?/*
+	dobashcomp contrib/completion/bash/docker
+	bashcomp_alias docker dockerd
+	insinto /usr/share/fish/vendor_completions.d/
+	doins contrib/completion/fish/docker.fish
+	insinto /usr/share/zsh/site-functions
+	doins contrib/completion/zsh/_*
+}
+
+pkg_postinst() {
+	has_version "app-containers/docker-buildx" && return
+	ewarn "the 'docker build' command is deprecated and will be removed in a"
+	ewarn "future release. If you need this functionality, install"
+	ewarn "app-containers/docker-buildx."
+}

sdk_container/src/third_party/portage-stable/app-containers/docker/Manifest

@@ -1,3 +1,4 @@
 DIST docker-28.0.1.tar.gz 17553228 BLAKE2B 8c172d58fb75d307983ace06b509e86ed533729d75a27af114939cad9022980f692368249f6ef514912aa90f1fa09998fd658377e28d2e2577d53b6f745cf5db SHA512 58c77ae139e5d32c4c263fa14ec4457f50240a15cd7934b4d2576af0295bfb5b62abbeef0ba78815f9041a01dbe3a8b35351eaebea1f584f54ef0d4192734048
 DIST docker-28.0.4.tar.gz 17579330 BLAKE2B 3b1ecb6ddceea0fe772bd597bf6b3c4b5867b691e35bbb0b05ad6ab0c4dc79193dbde02cdcb45c607c0dd704aeaa9629deffb098a0d1533dd3f5e9fb882ef34f SHA512 dfa6bc18c7cecf82c80e45c6a615e0cccb866a993ad2b6c3134e0f0d5d069b5abb0b8201029019a5396353f666252b5fd36b6a34080723af46291d3fda1c2608
 DIST docker-28.1.1.tar.gz 17719438 BLAKE2B 95307e9c03e4c1ad436fffe321f69c269c0fba9fea22c56963b503a051360b9a38170c865e42674ca17adde6690ed14da5039539e7f8d082e1304191d25c9ddb SHA512 15de0a10dc9d60be5c6047a30be5065ee69b9cde938654363cd27d71103057cc78510f546f7b161ba5f0b8b764dc6167e4ffebbcc9e69b171fe49ee1e09e97b2
+DIST docker-28.2.2.tar.gz 17861904 BLAKE2B 6f55e96d653579b749908080550ebee0635549fafd25c775fd59126018820a30f5234c680834a7ece897cb0f38f92f5afe3684d5dbc43694837516528c79f19b SHA512 e63ce38bb7badb01de918f678ad9fb216b279170177fe7d7c4120c8a1196add485cc974f9dff239a274220ebab60a2dc6852f07dc2ddafe8cec07c65dbd19a49

sdk_container/src/third_party/portage-stable/app-containers/docker/docker-28.2.2.ebuild

@@ -0,0 +1,333 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+MY_PV=${PV/_/-}
+
+inherit go-module linux-info optfeature systemd toolchain-funcs udev
+
+GIT_COMMIT=45873be4ae3f5488c9498b3d9f17deaddaf609f4
+
+DESCRIPTION="The core functions you need to create Docker images and run Docker containers"
+HOMEPAGE="https://www.docker.com/"
+SRC_URI="https://github.com/moby/moby/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/moby-${PV}"
+
+LICENSE="Apache-2.0"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor btrfs +container-init cuda +overlay2 seccomp selinux systemd"
+
+DEPEND="
+	acct-group/docker
+	>=dev-db/sqlite-3.7.9:3
+	apparmor? ( sys-libs/libapparmor )
+	btrfs? ( >=sys-fs/btrfs-progs-3.16.1 )
+	seccomp? ( >=sys-libs/libseccomp-2.2.1 )
+	systemd? ( sys-apps/systemd )
+"
+
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#runtime-dependencies
+# https://github.com/moby/moby/blob/master/project/PACKAGERS.md#optional-dependencies
+RDEPEND="
+	${DEPEND}
+	>=net-firewall/iptables-1.4
+	sys-process/procps
+	>=dev-vcs/git-1.7
+	>=app-arch/xz-utils-4.9
+	>=app-containers/containerd-1.7.27[apparmor?,btrfs?,seccomp?]
+	>=app-containers/runc-1.2.6[apparmor?,seccomp?]
+	!app-containers/docker-proxy
+	!<app-containers/docker-cli-${PV}
+	container-init? ( >=sys-process/tini-0.19.0[static] )
+	cuda? ( app-containers/nvidia-container-toolkit )
+	selinux? ( sec-policy/selinux-docker )
+"
+
+# https://github.com/docker/docker/blob/master/project/PACKAGERS.md#build-dependencies
+BDEPEND="
+	dev-go/go-md2man
+	virtual/pkgconfig
+"
+# tests require running dockerd as root and downloading containers
+RESTRICT="installsources strip test"
+
+# https://bugs.gentoo.org/748984 https://github.com/etcd-io/etcd/pull/12552
+pkg_setup() {
+	# this is based on "contrib/check-config.sh" from upstream's sources
+	# required features.
+	CONFIG_CHECK="
+		~NAMESPACES ~NET_NS ~PID_NS ~IPC_NS ~UTS_NS
+		~CGROUPS ~CGROUP_CPUACCT ~CGROUP_DEVICE ~CGROUP_FREEZER ~CGROUP_SCHED ~CPUSETS ~MEMCG
+		~KEYS
+		~VETH ~BRIDGE ~BRIDGE_NETFILTER
+		~IP_NF_FILTER ~IP_NF_RAW ~IP_NF_TARGET_MASQUERADE
+		~NETFILTER_XT_MATCH_ADDRTYPE
+		~NETFILTER_XT_MATCH_CONNTRACK
+		~NETFILTER_XT_MATCH_IPVS
+		~NETFILTER_XT_MARK
+		~IP_NF_NAT ~NF_NAT
+		~POSIX_MQUEUE
+	"
+	WARNING_POSIX_MQUEUE="CONFIG_POSIX_MQUEUE: is required for bind-mounting /dev/mqueue into containers"
+
+	if kernel_is lt 4 8; then
+		CONFIG_CHECK+="
+			~DEVPTS_MULTIPLE_INSTANCES
+		"
+	fi
+
+	if kernel_is le 5 1; then
+		CONFIG_CHECK+="
+			~NF_NAT_IPV4
+		"
+	fi
+
+	if kernel_is le 5 2; then
+		CONFIG_CHECK+="
+			~NF_NAT_NEEDED
+		"
+	fi
+
+	if kernel_is ge 4 15; then
+		CONFIG_CHECK+="
+			~CGROUP_BPF
+		"
+	fi
+
+	# optional features
+	CONFIG_CHECK+="
+		~USER_NS
+	"
+
+	if use seccomp; then
+		CONFIG_CHECK+="
+			~SECCOMP ~SECCOMP_FILTER
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~CGROUP_PIDS
+	"
+
+	if kernel_is lt 6 1; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP
+			"
+	fi
+
+	if kernel_is le 5 8; then
+		CONFIG_CHECK+="
+			~MEMCG_SWAP_ENABLED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NATIVE
+		"
+	if kernel_is lt 5 19; then
+		CONFIG_CHECK+="
+			~LEGACY_VSYSCALL_EMULATE
+			"
+	fi
+	CONFIG_CHECK+="
+		~!LEGACY_VSYSCALL_NONE
+		"
+	WARNING_LEGACY_VSYSCALL_NONE="CONFIG_LEGACY_VSYSCALL_NONE enabled: \
+		Containers with <=glibc-2.13 will not work"
+
+	if kernel_is le 4 5; then
+		CONFIG_CHECK+="
+			~MEMCG_KMEM
+		"
+	fi
+
+	if kernel_is lt 5; then
+		CONFIG_CHECK+="
+			~IOSCHED_CFQ ~CFQ_GROUP_IOSCHED
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~BLK_CGROUP ~BLK_DEV_THROTTLING
+		~CGROUP_PERF
+		~CGROUP_HUGETLB
+		~NET_CLS_CGROUP ~CGROUP_NET_PRIO
+		~CFS_BANDWIDTH ~FAIR_GROUP_SCHED
+		~IP_NF_TARGET_REDIRECT
+		~IP_VS
+		~IP_VS_NFCT
+		~IP_VS_PROTO_TCP
+		~IP_VS_PROTO_UDP
+		~IP_VS_RR
+		"
+
+	if use selinux; then
+		CONFIG_CHECK+="
+			~SECURITY_SELINUX
+			"
+	fi
+
+	if use apparmor; then
+		CONFIG_CHECK+="
+			~SECURITY_APPARMOR
+			"
+	fi
+
+	# if ! is_set EXT4_USE_FOR_EXT2; then
+	#	check_flags EXT3_FS EXT3_FS_XATTR EXT3_FS_POSIX_ACL EXT3_FS_SECURITY
+	#	if ! is_set EXT3_FS || ! is_set EXT3_FS_XATTR || ! is_set EXT3_FS_POSIX_ACL || ! is_set EXT3_FS_SECURITY; then
+	#		echo "    $(wrap_color '(enable these ext3 configs if you are using ext3 as backing filesystem)' bold black)"
+	#	fi
+	# fi
+
+	CONFIG_CHECK+="
+		~EXT4_FS ~EXT4_FS_POSIX_ACL ~EXT4_FS_SECURITY
+	"
+
+	# if ! is_set EXT4_FS || ! is_set EXT4_FS_POSIX_ACL || ! is_set EXT4_FS_SECURITY; then
+	#	if is_set EXT4_USE_FOR_EXT2; then
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext3 or ext4 as backing filesystem' bold black)"
+	#	else
+	#		echo "    $(wrap_color 'enable these ext4 configs if you are using ext4 as backing filesystem' bold black)"
+	#	fi
+	# fi
+
+	# network drivers
+	CONFIG_CHECK+="
+		~VXLAN ~BRIDGE_VLAN_FILTERING
+		~CRYPTO ~CRYPTO_AEAD ~CRYPTO_GCM ~CRYPTO_SEQIV ~CRYPTO_GHASH
+		~XFRM ~XFRM_USER ~XFRM_ALGO ~INET_ESP
+	"
+	if kernel_is le 5 3; then
+		CONFIG_CHECK+="
+			~INET_XFRM_MODE_TRANSPORT
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~IPVLAN
+		"
+	CONFIG_CHECK+="
+		~MACVLAN ~DUMMY
+		"
+	CONFIG_CHECK+="
+		~NF_NAT_FTP ~NF_CONNTRACK_FTP ~NF_NAT_TFTP ~NF_CONNTRACK_TFTP
+	"
+
+	# storage drivers
+	if use btrfs; then
+		CONFIG_CHECK+="
+			~BTRFS_FS
+			~BTRFS_FS_POSIX_ACL
+		"
+	fi
+
+	CONFIG_CHECK+="
+		~OVERLAY_FS
+	"
+
+	linux-info_pkg_setup
+}
+
+src_unpack() {
+	default
+	cd "${S}"
+	[[ -f go.mod ]] || ln -s vendor.mod go.mod || die
+	[[ -f go.sum ]] || ln -s vendor.sum go.sum || die
+}
+
+src_compile() {
+	export DOCKER_GITCOMMIT="${GIT_COMMIT}"
+	export VERSION=${PV}
+	tc-export PKG_CONFIG
+
+	# setup CFLAGS and LDFLAGS for separate build target
+	# see https://github.com/tianon/docker-overlay/pull/10
+	CGO_CFLAGS+=" -I${ESYSROOT}/usr/include"
+	CGO_LDFLAGS+=" -L${ESYSROOT}/usr/$(get_libdir)"
+
+	# let's set up some optional features :)
+	export DOCKER_BUILDTAGS=''
+	for gd in btrfs overlay2; do
+		if ! use $gd; then
+			DOCKER_BUILDTAGS+=" exclude_graphdriver_${gd//-/}"
+		fi
+	done
+
+	for tag in apparmor seccomp; do
+		if use $tag; then
+			DOCKER_BUILDTAGS+=" $tag"
+		fi
+	done
+
+	export AUTO_GOPATH=1
+	export EXCLUDE_AUTO_BUILDTAG_JOURNALD=$(usex systemd '' 'y')
+	export GO_MD2MAN=/usr/bin/go-md2man
+
+	# build binaries
+	./hack/make.sh dynbinary || die 'dynbinary failed'
+
+	# build man page
+	cd man || die
+	emake || die
+}
+
+src_install() {
+	dosym containerd /usr/bin/docker-containerd
+	dosym containerd-shim-runc-v2 /usr/bin/docker-containerd-shim
+	dosym runc /usr/bin/docker-runc
+	use container-init && dosym tini /usr/bin/docker-init
+	dobin bundles/dynbinary-daemon/dockerd
+	dobin bundles/dynbinary-daemon/docker-proxy
+	for f in dockerd-rootless-setuptool.sh dockerd-rootless.sh; do
+		dosym ../share/docker/contrib/${f} /usr/bin/${f}
+	done
+
+	newinitd contrib/init/openrc/docker.initd docker
+	newconfd contrib/init/openrc/docker.confd docker
+
+	systemd_dounit contrib/init/systemd/docker.{service,socket}
+
+	udev_dorules contrib/udev/*.rules
+
+	dodoc AUTHORS CONTRIBUTING.md NOTICE README.md
+	dodoc -r docs/*
+	doman man/man8/dockerd.8
+
+	# note: intentionally not using "doins" so that we preserve +x bits
+	dodir /usr/share/${PN}/contrib
+	cp -R contrib/* "${ED}/usr/share/${PN}/contrib"
+}
+
+pkg_postinst() {
+	udev_reload
+
+	elog
+	elog "To use Docker, the Docker daemon must be running as root. To automatically"
+	elog "start the Docker daemon at boot:"
+	if systemd_is_booted || has_version sys-apps/systemd; then
+		elog "  systemctl enable docker.service"
+	else
+		elog "  rc-update add docker default"
+	fi
+	elog
+	elog "To use Docker as a non-root user, add yourself to the 'docker' group:"
+	elog '  usermod -aG docker <youruser>'
+	elog
+
+	if has_version sys-fs/zfs; then
+		elog " ZFS storage driver is available"
+		elog " Check https://docs.docker.com/storage/storagedriver/zfs-driver for more info"
+		elog
+	fi
+
+	optfeature "rootless mode support" sys-apps/shadow
+	optfeature "rootless mode support" sys-apps/rootlesskit
+	optfeature_header "for rootless mode you also need a network stack"
+	optfeature "rootless mode network stack" app-containers/slirp4netns
+}
+
+pkg_postrm() {
+	udev_reload
+}

sdk_container/src/third_party/portage-stable/app-containers/incus/Manifest

@@ -2,9 +2,7 @@ DIST incus-6.0.3.tar.xz 11916020 BLAKE2B d3d998bd50124604c52ff007eefed586c216ce1
 DIST incus-6.0.3.tar.xz.asc 833 BLAKE2B 38835ab036709161150992cb40df4ff1ae1887d4f3e0b037d0415f75d2bb711cb3c5945bffe1b91d289acfb7e19e726964278e5c2ab31731ba9f7534f139dec7 SHA512 7d5360ab91aafe1d047a60e38a07e24c3c7b158e753087a943ec5e59d6a27c19a872080c9007b6cf592040d3408845bc188d76f6e732408d0680a3782cebce47
 DIST incus-6.0.4.tar.xz 12000208 BLAKE2B 99a4ba40d2eea48515b88f4534c282adc925fe1b5487dc98901f000894b3781aec89f617d2246314cf9a95a7d65531e486c4092f8939722e1b3c2bf7d33063c8 SHA512 14a5cdad3f9365d58e526c8f451d9e7a57729010073caff31256e0b94d28206adc82ead4820278e7eac17b74d22a76d9f3b9f5f8424ddbfa6b74a5cea13e019f
 DIST incus-6.0.4.tar.xz.asc 833 BLAKE2B 96c94cde55cd2e9f7f28db7adb098adf4895437d300dfd42aeac540cdab6677fb604831c28f40f8581e60b89b228557d81696cd64950a1c2147b445a5ec58b30 SHA512 1ef2063eab424467c805f8c86b5b0caca848f46d2ef7ebf602049fe32ee15a7e1006d5a2710b355604aef73802b4333cd0428c772e1c5fc4da588c2cd7ee1694
-DIST incus-6.10.1.tar.xz 18023076 BLAKE2B c35c7a81448b17db6db8959458c23a58392d9e3dcfedaf6d1094964c0c35d46d551a4d6cbaab93cde4b9006bdeb064dcc50148fc2cded6c9ca122f635dab58cd SHA512 12566fef798b34e3d1f3abe4bebada50a99f0e30fd33e1c5ffab458a2ebdac484650e6bf35a48bc4680669d24c9fd912b549e43ed01318bdac52d1b1767cb275
-DIST incus-6.10.1.tar.xz.asc 833 BLAKE2B 2e2de67bae59502fdad66a7ac5b7771d4e305f87e4b3e35bc829a73bd053a7ca8256f9bfa8e4c2fc6ee2268cdc8bd9b9bac7ed319e5cda14829daeaa39108b51 SHA512 4f00405913b0d04a0eec407756928e59e477ecf4dfc07b063a13fc5683fcc6e18efe1d2947a6b9c12e5fb1b64d39dc076f4a41da129fe132d30e7cfc23af80a4
-DIST incus-6.11.tar.xz 11997736 BLAKE2B 8764c1189fceeb65caedc0b9cf562f8f78a4e905101022c4efe98693ed70ef069b580d10f74e1830e0225a5332b5b37a9068c636aec738a6496a01430d6074c3 SHA512 0d52e71ce55aa59bb2b3a4c9f7926d43a6dfae1809d42c2c0c591019eaef648a4e15159a826de382e06149aa3488d60c283f69055335124d85597199d231367f
-DIST incus-6.11.tar.xz.asc 833 BLAKE2B b399138638c2c503600b29899b81a4ce691af2ad16ab2d8f8994c92e317e0b48dc2021095346e9784f58a631b724c134186be026acb06fb9a63a01cc0d1cb970 SHA512 f2b108129fe3111e184544b4fce8d5503b59764b202582c901699602d3a7434e3876684ad0f625b7beeb8ca92e6cd9468ced804bcbb8e00336d48d4bce4de1fe
 DIST incus-6.12.tar.xz 12041616 BLAKE2B 25bb157839a6d86f45614f71cb8f61ec2d92ca96322e90dc9d4f47603aee8b246621b941cd223a3c9007bbb4dbb65ffe432a72d2e7af5fefae40bc398406424b SHA512 1234f54965f2b50fa04c286405dd3b7dcbf86f88f91dd38476695a57961dd13fbc8da3c698ce1c254da71239b4af64fda25b9de7c6db017e7728b5bc4db52bf4
 DIST incus-6.12.tar.xz.asc 833 BLAKE2B e74dbefea68db25458da3956e6b5fc99b2cc861d9a20c5d10a9fa2d1803068b2b36a350d35960bfb289e9e1e747baa8bc5d2fdb0a93fcfb8ee7b0ffcd65befe7 SHA512 11f63160366a17d7d2679eb52f318d3c0e2a6d91a76c968d6483db9fb45892006d831f85e30bedfa9237a55d9b517458b01c3d1311e7e5f9ea1c3b3bbc18975a
+DIST incus-6.13.tar.xz 12416404 BLAKE2B 0eca3b80762e9473be21f29157eb42d655a09db97084f6cccd1317595f96593c866110c19a4a42592ae556e8f2f3e40153a7430730373cdb777261bc4a8f0d5e SHA512 80411e23aa95f021f349463b15146444bba7f5cad42e094ff099ec70df8083d7b54d8374ef659d3f4d01afbcbf4287b7238e973d53fecd9a7af046df85b1b05f
+DIST incus-6.13.tar.xz.asc 833 BLAKE2B fbdb41110452716aa333f444801152456ec1196cbdb151c5dfdb940d3e82e39cbbc70990ec999b723938ec3986deafff0c1e77376cdd19fb862aa8c59083d363 SHA512 a29978fd9d9f89f7ae6585f150cf78ec7819360e189ce6bbb5559049cecd2b667a46857a852a77d22edba60fce083c2bfccbf89535dad7d415e82c0eec995700

sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.3-r1.ebuild

@@ -158,8 +158,7 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
-	if [ "${GOARCH}" != "${GOHOSTARCH}" ]; then
+	if tc-is-cross-compiler ; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"

sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.0.4-r1.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
 
 DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
 HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
@@ -153,7 +153,8 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	if tc-is-cross-compiler ; then
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"

sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.12-r1.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
 
 DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
 HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
@@ -155,7 +155,8 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	if tc-is-cross-compiler ; then
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"

sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.13-r1.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
 
 DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
 HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
@@ -39,6 +39,7 @@ RDEPEND="${DEPEND}
 	>=sys-fs/lxcfs-5.0.0
 	sys-fs/squashfs-tools[lzma]
 	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
 	qemu? (
 		app-cdr/cdrtools
 		app-emulation/qemu[spice,usbredir,virtfs]
@@ -142,7 +143,21 @@ src_compile() {
 
 	# Needs to be built statically
 	CGO_ENABLED=0 go install -v -tags netgo "${S}"/cmd/incus-migrate
-	CGO_ENABLED=0 go install -v -tags agent,netgo "${S}"/cmd/incus-agent
+
+	# Build the VM agents, statically too
+	# 32-bit agents couldn't be built with the settings below, will need to investigate later - maybe
+	if use amd64 ; then
+		GOARCH=amd64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.x86_64 -v -tags agent,netgo "${S}"/cmd/incus-agent
+		# GOARCH=386 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.i686 -v -tags agent,netgo "${S}"/cmd/incus-agent
+		GOARCH=amd64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.x86_64 -v -tags agent,netgo "${S}"/cmd/incus-agent
+		# GOARCH=386 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.i686 -v -tags agent,netgo "${S}"/cmd/incus-agent
+	elif use arm64 ; then
+		GOARCH=arm64 CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.linux.aarch64 -v -tags agent,netgo "${S}"/cmd/incus-agent
+		GOARCH=arm64 GOOS=windows CGO_ENABLED=0 ego build -o "${S}"/_dist/bin/incus-agent.windows.aarch64 -v -tags agent,netgo "${S}"/cmd/incus-agent
+	else
+		echo "No VM support for this arch."
+		return
+	fi
 
 	use nls && emake build-mo
 }
@@ -154,7 +169,8 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	if tc-is-cross-compiler ; then
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"
@@ -164,14 +180,25 @@ src_install() {
 
 	# Admin tools
 	for l in incusd incus-user lxd-to-incus ; do
-		dosbin ${bindir}/${l}
+		dosbin "${bindir}/${l}"
 	done
 
 	# User tools
-	for m in incus-agent incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
-		dobin ${bindir}/${m}
+	for m in incus-benchmark incus-migrate incus-simplestreams incus lxc-to-incus ; do
+		dobin "${bindir}/${m}"
 	done
 
+	# VM Agents
+	if use amd64 ; then
+		dobin ${bindir}/incus-agent.linux.x86_64
+		# dobin ${bindir}/incus-agent.linux.i686
+		dobin ${bindir}/incus-agent.windows.x86_64
+		# dobin ${bindir}/incus-agent.windows.i686
+	elif use arm64 ; then
+		dobin ${bindir}/incus-agent.linux.aarch64
+		dobin ${bindir}/incus-agent.windows.aarch64
+	fi
+
 	# fuidshift, should be moved under admin tools at some point
 	if use fuidshift ; then
 		dosbin ${bindir}/fuidshift
@@ -214,6 +241,7 @@ pkg_postinst() {
 	elog "  https://wiki.gentoo.org/wiki/Incus#Migrating_from_LXD"
 	elog
 	optfeature "OCI container images support" app-containers/skopeo app-containers/umoci
+	optfeature "support for ACME certificate issuance" app-crypt/lego
 	optfeature "btrfs storage backend" sys-fs/btrfs-progs
 	optfeature "ipv6 support" net-dns/dnsmasq[ipv6]
 	optfeature "full incus-migrate support" net-misc/rsync

sdk_container/src/third_party/portage-stable/app-containers/incus/incus-6.13.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-inherit go-module linux-info optfeature systemd toolchain-funcs verify-sig
+inherit go-env go-module linux-info optfeature systemd toolchain-funcs verify-sig
 
 DESCRIPTION="Modern, secure and powerful system container and virtual machine manager"
 HOMEPAGE="https://linuxcontainers.org/incus/introduction/ https://github.com/lxc/incus"
@@ -39,6 +39,7 @@ RDEPEND="${DEPEND}
 	>=sys-fs/lxcfs-5.0.0
 	sys-fs/squashfs-tools[lzma]
 	virtual/acl
+	apparmor? ( sec-policy/apparmor-profiles )
 	qemu? (
 		app-cdr/cdrtools
 		app-emulation/qemu[spice,usbredir,virtfs]
@@ -154,7 +155,8 @@ src_test() {
 src_install() {
 	export GOPATH="${S}/_dist"
 
-	if tc-is-cross-compiler ; then
+	export GOHOSTARCH=$(go-env_goarch "${CBUILD}")
+	if [[ "${GOARCH}" != "${GOHOSTARCH}" ]]; then
 		local bindir="_dist/bin/linux_${GOARCH}"
 	else
 		local bindir="_dist/bin"

sdk_container/src/third_party/portage-stable/app-containers/runc/Manifest

@@ -1,3 +1,4 @@
 DIST runc-1.2.4.tar.gz 2759394 BLAKE2B 02b282c9fbe7f82ad1d4297b9d2576ee99db7f4db193aa6b08b595d1a18f4a0cb41c5fddb8184ca389e77726c71f4b64b686b2ee1b8e8df97179669362c17ff7 SHA512 2a14bfe7759e0cefcf88fac9d756eb2cbed8a9ebf7b6eacb96855467ea151c278ae0d58735d2a5a2d3335fc54eae4625dfcdb641065df58ba10fd1faafbd3119
 DIST runc-1.2.5.tar.gz 2763738 BLAKE2B 446dd633d94f41957ba205b944320734ddf505e1bdc8f6f9d1002de8ecdd46368af19d788b8812cee87aaab1f8583d01e0c4d6fd0a56590a819588814bfb1841 SHA512 67dd870a24cfe896ead01f156eda6076b14bf287781734c2c4ab0e313d66f49bbf8d51705c5f0c24a604df311439c769a95cbfda12c7fa87ab2e6a31801a6984
 DIST runc-1.2.6.tar.gz 2763135 BLAKE2B d5e40e95f8c0069073d0010d120aca1828e585b103ecd671fca072138ef3528a316414cfac5ca725f45cb84f23ab4216d9e6f466beb118fb2813ab4be3a18e92 SHA512 9a89295e001914726dfc1040729301f62ad6b630943c65f7ade6ed460ef4a2f5f35cf40662730a9e8a6c6d0301a3c9959a85973097ceb8db05c043f9c1a86248
+DIST runc-1.3.0.tar.gz 2858199 BLAKE2B c9402a074b816b9452763267a7ffdc69af6c0cd4cf54fbdfdc91ccbd8bbc5daa783259176775e90f6266fa6a02bf0bad7fbb8eb879b5764309f7f9cd2f246086 SHA512 63422501f6189d0d47f6b2f59565de572bc68b138a65c7dbcc8b5ad42dbc37245ee66e2683ab61971a84c076a15f54f484c37fde4a30815ee19edc9a0d97e9f4

sdk_container/src/third_party/portage-stable/app-containers/runc/runc-1.3.0.ebuild

@@ -0,0 +1,71 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit go-module linux-info
+
+# update on bump, look for commit ID on release tag.
+# https://github.com/opencontainers/runc
+RUNC_COMMIT=4ca628d1d4c974f92d24daccb901aa078aad748e
+
+CONFIG_CHECK="~USER_NS"
+
+DESCRIPTION="runc container cli tools"
+HOMEPAGE="https://github.com/opencontainers/runc/"
+MY_PV="${PV/_/-}"
+SRC_URI="https://github.com/opencontainers/${PN}/archive/v${MY_PV}.tar.gz -> ${P}.tar.gz"
+S="${WORKDIR}/${PN}-${MY_PV}"
+
+LICENSE="Apache-2.0 BSD-2 BSD MIT"
+SLOT="0"
+KEYWORDS="~amd64 ~arm ~arm64 ~ppc64 ~riscv ~x86"
+IUSE="apparmor hardened +kmem +seccomp selinux test"
+
+COMMON_DEPEND="
+	apparmor? ( sys-libs/libapparmor )
+	seccomp? ( sys-libs/libseccomp )"
+DEPEND="${COMMON_DEPEND}"
+RDEPEND="${COMMON_DEPEND}
+	!app-emulation/docker-runc
+	selinux? ( sec-policy/selinux-container )"
+BDEPEND="
+	dev-go/go-md2man
+	test? ( "${RDEPEND}" )"
+
+# tests need busybox binary, and portage namespace
+# sandboxing disabled: mount-sandbox pid-sandbox ipc-sandbox
+# majority of tests pass
+RESTRICT+=" test"
+
+src_compile() {
+	# build up optional flags
+	local options=(
+		$(usev apparmor)
+		$(usev seccomp)
+		$(usex kmem '' 'nokmem')
+	)
+
+	myemakeargs=(
+		BUILDTAGS="${options[*]}"
+		COMMIT="${RUNC_COMMIT}"
+	)
+
+	emake "${myemakeargs[@]}" runc man
+}
+
+src_install() {
+	myemakeargs+=(
+		PREFIX="${ED}/usr"
+		BINDIR="${ED}/usr/bin"
+		MANDIR="${ED}/usr/share/man"
+	)
+	emake "${myemakeargs[@]}" install install-man install-bash
+
+	local DOCS=( README.md PRINCIPLES.md docs/. )
+	einstalldocs
+}
+
+src_test() {
+	emake "${myemakeargs[@]}" localunittest
+}

sdk_container/src/third_party/portage-stable/app-crypt/argon2/Manifest

@@ -1 +1 @@
-DIST argon2-20190702.tar.gz 1505307 BLAKE2B fa9c3dde7b39c8d797a3d6b52992ebfe35f5eba1c7d7b3aa02c440edc36a3f5186cacee2e39e27ed7c6356dc1970dac0e8198d6f2065eb63ff77f9dfb2937cf8 SHA512 0a4cb89e8e63399f7df069e2862ccd05308b7652bf4ab74372842f66bcc60776399e0eaf979a7b7e31436b5e6913fe5b0a6949549d8c82ebd06e0629b106e85f
+DIST phc-winner-argon2-20190702.tar.gz 1505307 BLAKE2B fa9c3dde7b39c8d797a3d6b52992ebfe35f5eba1c7d7b3aa02c440edc36a3f5186cacee2e39e27ed7c6356dc1970dac0e8198d6f2065eb63ff77f9dfb2937cf8 SHA512 0a4cb89e8e63399f7df069e2862ccd05308b7652bf4ab74372842f66bcc60776399e0eaf979a7b7e31436b5e6913fe5b0a6949549d8c82ebd06e0629b106e85f

sdk_container/src/third_party/portage-stable/app-crypt/argon2/argon2-20190702-r1.ebuild

@@ -1,21 +1,24 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 inherit toolchain-funcs
 
+MY_P=phc-winner-${P}
 DESCRIPTION="Password hashing software that won the Password Hashing Competition (PHC)"
-HOMEPAGE="https://github.com/P-H-C/phc-winner-argon2"
-SRC_URI="https://github.com/P-H-C/phc-winner-argon2/archive/${PV}.tar.gz -> ${P}.tar.gz"
+HOMEPAGE="https://github.com/P-H-C/phc-winner-argon2/"
+SRC_URI="
+	https://github.com/P-H-C/phc-winner-argon2/archive/${PV}.tar.gz
+		-> ${MY_P}.tar.gz
+"
+S=${WORKDIR}/${MY_P}
 
 LICENSE="|| ( Apache-2.0 CC0-1.0 )"
 SLOT="0/1"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
 IUSE="static-libs"
 
-S="${WORKDIR}/phc-winner-${P}"
-
 DOCS=( argon2-specs.pdf CHANGELOG.md README.md )
 
 src_prepare() {
@@ -44,16 +47,26 @@ src_prepare() {
 }
 
 src_compile() {
-	emake OPTTEST="${OPTTEST}" LIBRARY_REL="$(get_libdir)" PREFIX="${EPREFIX}/usr" \
+	emake \
+		OPTTEST="${OPTTEST}" \
+		LIBRARY_REL="$(get_libdir)" \
+		PREFIX="${EPREFIX}/usr" \
 		ARGON2_VERSION="0~${PV}"
 }
 
 src_test() {
-	emake OPTTEST="${OPTTEST}" test
+	emake \
+		OPTTEST="${OPTTEST}" \
+		test
 }
 
 src_install() {
-	emake OPTTEST="${OPTTEST}" DESTDIR="${ED}" LIBRARY_REL="$(get_libdir)" install
+	emake \
+		OPTTEST="${OPTTEST}" \
+		DESTDIR="${ED}" \
+		LIBRARY_REL="$(get_libdir)" \
+		install
+
 	einstalldocs
 	doman man/argon2.1
 }

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/Manifest

@@ -2,5 +2,7 @@ DIST gnupg-2.2.45.tar.bz2 7447141 BLAKE2B 8fe2036325e31332166c0477ce9514152c8417
 DIST gnupg-2.2.45.tar.bz2.sig 119 BLAKE2B 6656747b2d640a95c4172a221952fa75f7d03c231b7c6d40ea57b43a5bcfbceb800023ca2f352ca09325aaf186a7bf31fcfe7104129c5d6628f0e1256994df76 SHA512 181195a76eede8113bd8f2a7f5bc20674226f6327cf8263389e3d178c205ed2d817b28f2d3b504dd9f852f22fc283d2c14e809ba1c05cfe88b66103845ff114c
 DIST gnupg-2.4.7.tar.bz2 8010244 BLAKE2B 4cdc6be4330b0c8f150d9d1a9ce9c7d34232ecf9b980b15fbd20e96ff6fcd8665688456d66f1c862b816472034eaa0796444357b1f36e75e8520a603a0e6b298 SHA512 3e84f1679904bf0efb789df6466e468bd2be9149d52561f35e2380038133479bebf1c61ee7adf6d3564b370915f32111098c052be6e6acaf3083a807f9f36019
 DIST gnupg-2.4.7.tar.bz2.sig 119 BLAKE2B e97012f433c2818dda953ccaa2f5e8e94492b306a7815b16d7a9f8bf165f11972114d94a1aaba6156baed0ee3566ad998ed74a9521c71464268f4c6f8f14306c SHA512 d944a57b21fa7a4058fb4f00e3c164220be038037010a07a43e48c881dd66d901f8ea249f5df183a1c7de811ecc3aa9ed1591c18baf201e338129eb7e28bddc4
+DIST gnupg-2.4.8.tar.bz2 8017685 BLAKE2B ab7126aac6c7bf323075c68084c963f75d93c729d8918b6ca10ef0a4466879636433c682a5437776d2ce9f5d432e1f66995dd94a4f44d7f184542f030087dbb2 SHA512 d7f07a258141a583bc8be18c0984d7dfe8508f12c624c053881ee63dfee11adcda8de216bcaaef9f5d24a1e217de70bf69ee2e3cc43b0da66a0e571ce9c4b436
+DIST gnupg-2.4.8.tar.bz2.sig 119 BLAKE2B 4f94b2abc40b17cfab44f28fc2a2ae5246f8356141a3932a92b5adb78002c7064bb132a6529079bc14900036f90d9d318d7d01818999150e2c875b88a3fca265 SHA512 9fb54be4e99ecee6c7b649d6f0ef24a25e81c0af57e07ccdd512a1ea2ebf7558dd25518b7b78347e4a216167849e6285bb91ec23d0968966aba0784d45f02a06
 DIST gnupg-2.5.1.tar.bz2 8126739 BLAKE2B 46955d2eebe14395adc0fdf81e89a32f3f9baaabfe1eee78f256a1fab25ce6fdb96b873678cfeb5e4abf4894c7ab4908359ed04cc6571ff442dcc5325b3ccd66 SHA512 733a11ff24145e23dd7d34d954a70c25bf70ecb1d517b8e15cc34bf690786c9f7007e4e99cde573500ac012852e91b29568fed00491f8c8254b3fb63ca5777cd
 DIST gnupg-2.5.1.tar.bz2.sig 238 BLAKE2B cd024a63ecb82a12e92444cbff8dbc9bef6a4e436d59957aae77927cce0baf9e282e63df7a5159a521c7c8694a0dbe96d6537ad3ec5f779c7c0dea8d02b5e70d SHA512 8ffd5cc72a2907972bf1854e804f6c215ff66ba2d6e91952700f49b2b5ba8bab035d0f42efdb0d3c3166301cda6e716394928bdd9c0d0d1e1789a02c7aa1a926

sdk_container/src/third_party/portage-stable/app-crypt/gnupg/gnupg-2.4.8.ebuild

@@ -0,0 +1,196 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+# in-source builds are not supported: https://dev.gnupg.org/T6313#166339
+inherit flag-o-matic out-of-source multiprocessing systemd toolchain-funcs verify-sig
+
+MY_P="${P/_/-}"
+
+DESCRIPTION="The GNU Privacy Guard, a GPL OpenPGP implementation"
+HOMEPAGE="https://gnupg.org/"
+SRC_URI="mirror://gnupg/gnupg/${MY_P}.tar.bz2"
+SRC_URI+=" verify-sig? ( mirror://gnupg/gnupg/${P}.tar.bz2.sig )"
+S="${WORKDIR}/${MY_P}"
+
+LICENSE="GPL-3+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="bzip2 doc ldap nls readline selinux +smartcard ssl test +tofu tpm tools usb user-socket wks-server"
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test? ( tofu )"
+
+# Existence of executables is checked during configuration.
+# Note: On each bump, update dep bounds on each version from configure.ac!
+DEPEND="
+	>=dev-libs/libassuan-2.5.0:=
+	>=dev-libs/libgcrypt-1.9.1:=
+	>=dev-libs/libgpg-error-1.46
+	>=dev-libs/libksba-1.6.3
+	>=dev-libs/npth-1.2
+	sys-libs/zlib
+	bzip2? ( app-arch/bzip2 )
+	ldap? ( net-nds/openldap:= )
+	readline? ( sys-libs/readline:0= )
+	smartcard? ( usb? ( virtual/libusb:1 ) )
+	tofu? ( >=dev-db/sqlite-3.27 )
+	tpm? ( >=app-crypt/tpm2-tss-2.4.0:= )
+	ssl? ( >=net-libs/gnutls-3.2:0= )
+"
+RDEPEND="
+	${DEPEND}
+	nls? ( virtual/libintl )
+	selinux? ( sec-policy/selinux-gpg )
+	wks-server? ( virtual/mta )
+"
+PDEPEND="
+	app-crypt/pinentry
+"
+BDEPEND="
+	virtual/pkgconfig
+	doc? ( sys-apps/texinfo )
+	nls? ( sys-devel/gettext )
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+DOCS=(
+	ChangeLog NEWS README THANKS TODO VERSION
+	doc/FAQ doc/DETAILS doc/HACKING doc/TRANSLATE doc/OpenPGP doc/KEYSERVER
+)
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.1.20-gpgscm-Use-shorter-socket-path-lengts-to-improve-tes.patch
+)
+
+src_prepare() {
+	default
+
+	GNUPG_SYSTEMD_UNITS=(
+		dirmngr.service
+		dirmngr.socket
+		gpg-agent-browser.socket
+		gpg-agent-extra.socket
+		gpg-agent.service
+		gpg-agent.socket
+		gpg-agent-ssh.socket
+	)
+
+	cp "${GNUPG_SYSTEMD_UNITS[@]/#/${FILESDIR}/}" "${T}" || die
+
+	# Inject SSH_AUTH_SOCK into user's sessions after enabling gpg-agent-ssh.socket in systemctl --user mode,
+	# idea borrowed from libdbus, see
+	#   https://gitlab.freedesktop.org/dbus/dbus/-/blob/master/bus/systemd-user/dbus.socket.in#L6
+	#
+	# This cannot be upstreamed, as it requires determining the exact prefix of 'systemctl',
+	# which in turn requires discovery in Autoconf, something that upstream deeply resents.
+	sed -e "/DirectoryMode=/a ExecStartPost=-${EPREFIX}/bin/systemctl --user set-environment SSH_AUTH_SOCK=%t/gnupg/S.gpg-agent.ssh" \
+		-i "${T}"/gpg-agent-ssh.socket || die
+}
+
+my_src_configure() {
+	# Upstream don't support LTO, bug #854222.
+	filter-lto
+
+	local myconf=(
+		$(use_enable bzip2)
+		$(use_enable nls)
+		$(use_enable smartcard scdaemon)
+		$(use_enable ssl gnutls)
+		$(use_enable test all-tests)
+		$(use_enable test tests)
+		$(use_enable tofu)
+		$(use_enable tofu keyboxd)
+		$(use_enable tofu sqlite)
+		$(usex tpm '--with-tss=intel' '--disable-tpm2d')
+		$(use smartcard && use_enable usb ccid-driver || echo '--disable-ccid-driver')
+		$(use_enable wks-server wks-tools)
+		$(use_with ldap)
+		$(use_with readline)
+
+		# Hardcode mailprog to /usr/libexec/sendmail even if it does not exist.
+		# As of GnuPG 2.3, the mailprog substitution is used for the binary called
+		# by wks-client & wks-server; and if it's autodetected but not not exist at
+		# build time, then then 'gpg-wks-client --send' functionality will not
+		# work. This has an unwanted side-effect in stage3 builds: there was a
+		# [R]DEPEND on virtual/mta, which also brought in virtual/logger, bloating
+		# the build where the install guide previously make the user chose the
+		# logger & mta early in the install.
+		--with-mailprog=/usr/libexec/sendmail
+
+		--disable-ntbtls
+		--enable-gpgsm
+		--enable-large-secmem
+
+		CC_FOR_BUILD="$(tc-getBUILD_CC)"
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+
+		$("${S}/configure" --help | grep -o -- '--without-.*-prefix')
+	)
+
+	if use prefix && use usb; then
+		# bug #649598
+		append-cppflags -I"${ESYSROOT}/usr/include/libusb-1.0"
+	fi
+
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		# https://dev.gnupg.org/T7368
+		append-cppflags -D_XOPEN_SOURCE=500
+	fi
+
+	# bug #663142
+	if use user-socket; then
+		myconf+=( --enable-run-gnupg-user-socket )
+	fi
+
+	# glib fails and picks up clang's internal stdint.h causing weird errors
+	tc-is-clang && export gl_cv_absolute_stdint_h="${ESYSROOT}"/usr/include/stdint.h
+
+	econf "${myconf[@]}"
+}
+
+my_src_compile() {
+	default
+
+	use doc && emake -C doc html
+}
+
+my_src_test() {
+	export TESTFLAGS="--parallel=$(makeopts_jobs)"
+
+	default
+}
+
+my_src_install() {
+	emake DESTDIR="${D}" install
+
+	use tools && dobin tools/{gpgconf,gpgsplit,gpg-check-pattern} tools/make-dns-cert
+
+	dosym gpg /usr/bin/gpg2
+	dosym gpgv /usr/bin/gpgv2
+	echo ".so man1/gpg.1" > "${ED}"/usr/share/man/man1/gpg2.1 || die
+	echo ".so man1/gpgv.1" > "${ED}"/usr/share/man/man1/gpgv2.1 || die
+
+	dodir /etc/env.d
+	echo "CONFIG_PROTECT=/usr/share/gnupg/qualified.txt" >> "${ED}"/etc/env.d/30gnupg || die
+
+	use doc && dodoc doc/gnupg.html/*
+}
+
+my_src_install_all() {
+	einstalldocs
+
+	use tools && dobin tools/{convert-from-106,mail-signed-keys,lspgpot}
+	use doc && dodoc doc/*.png
+
+	# Dropped upstream in https://git.gnupg.org/cgi-bin/gitweb.cgi?p=gnupg.git;a=commitdiff;h=eae28f1bd4a5632e8f8e85b7248d1c4d4a10a5ed.
+	dodoc "${FILESDIR}"/README-systemd
+	systemd_douserunit "${GNUPG_SYSTEMD_UNITS[@]/#/${T}/}"
+}

sdk_container/src/third_party/portage-stable/app-crypt/gpgme/Manifest

@@ -1,4 +1,6 @@
-DIST gpgme-1.24.1.tar.bz2 1891695 BLAKE2B 8438291baec336c329deb9b864e1f3d2710066b992495a82cf83b264b52166e65bfb997aa7a06a18d90bd1048772da8ab6189ba114dd5117f50614dc8210cd37 SHA512 13e90371a733bca4cfefeac0588059d9fab3310b63c58c759f5ba9f9fddc6b0bdab6493fc2bc129c0ebe102ce4effa8067823937d3382f7c7ff02183717bbfd6
-DIST gpgme-1.24.1.tar.bz2.sig 119 BLAKE2B 95232e31a8402cc5ec79d3a459ec6e35feb2d419dc7ac49b8e78103159ca472aac648e97acc3723dee4f2301e2333356e2b1f4376f423d8a3ef3734913249e69 SHA512 11650ea2af3e1c865eafc3c55632befeb036ce0435c32770dd6d6a03026ba7d343e9dcb3ab3597f6b6aae317f1aa26fa1e824f36caaf7214422b8b7ec76cc953
 DIST gpgme-1.24.2.tar.bz2 1891804 BLAKE2B 3d112fe3401c6143d09474eefcc3fda00394b0db61c37d7da79ddf3352c71b67e2972800efbefa89bba4726a4997ef473c3dbdac8c5d42612a73332711cf4d4a SHA512 ad69101d1fceef6cd1dd6d5348f6f2be06912da6b6a7d0fece3ce08cf35054e6953b80ca9c4748554882892faa44e7c54e705cf25bbf2b796cd4ad12b09da185
 DIST gpgme-1.24.2.tar.bz2.sig 119 BLAKE2B 015c8243e84b36110985c1524c8ce124d2756bdcbb4a74ad046620516f3fba8a93e2d9d5aedbb720ed096d171bce71b4bc24e6fdf8b6ba59c263dd4c3c672c5a SHA512 1010067b40f2720e278577ae7599c957e26fdf81d35e21ea878813f2a2bdb618a4be636726252068438c9ef89cae9c1cd3e4acaf27243359abc3e5cfd7a87855
+DIST gpgme-1.24.3.tar.bz2 1892862 BLAKE2B ace04d4fc803f6ce96f850a46b4b383ebdcbfe51d55fbe2a5ced10451310553c15ee5a603d1e6ffb78a8de75461fafacc296fec3e4f38d4908171a095cab185f SHA512 3b5fc22a2f83576058ac14e744333f46df362b39f742d6c9e54a5a66828194a1312f5f365bdc15683e148821f5d591fa92a2daad83fc116f65dccf14e817ca48
+DIST gpgme-1.24.3.tar.bz2.sig 238 BLAKE2B 5b8402b011899faae26bcba428e45a7bb7baf9b16e4c605cdae3d84dc1cbf52ccd524181ef0726e25075c42f9ccb72cd996707a2f96c04b7054cc9050270b586 SHA512 056b28b041dd83c86984e73c31403ea45d33db30c1b2b05e45b0cfb5bb723b25a0fa21ddee192c135cea5d93d934502085bc0fc94fa3c29858513e260c332948
+DIST gpgme-2.0.0.tar.bz2 1383911 BLAKE2B 7053955f80f9a69c62d8b4bb6cc80ea259e6854857b340577c4a68fac1d34c0f2aff1dbbf88b503dd2b021c48d9fff67709593817f3b0e74f72df913d7e3de0d SHA512 ee58dc2a4273c740d5b9ef13cc655d5e600ddddd137fb85a781c31e8854829283b4ce241d7810a963d9a125d603213600f37e7d0c1ce3b3cf1b935e62cf60777
+DIST gpgme-2.0.0.tar.bz2.sig 119 BLAKE2B 3fe43a1047f8fba1fe793b5f501b9902067b3eea8d08713c4358d78b7c0c19b82e417251dbe602d04c2f945e46e0c5651bead5a2bf59dfc0861d1e9261893a98 SHA512 fc7b3cafd0e9d830c1709a086185047ecf118997feaa8896707917c420d12386c6e298116b457fea478c2e2f85fc9413ab3fa268a1798793377e4739419fde66

sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.2.ebuild

@@ -12,7 +12,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
 
 # in-source builds are not supported:

sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-1.24.3.ebuild

@@ -12,7 +12,7 @@ EAPI=8
 DISTUTILS_EXT=1
 DISTUTILS_OPTIONAL=1
 DISTUTILS_USE_PEP517=setuptools
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
 
 # in-source builds are not supported:
@@ -34,7 +34,7 @@ LICENSE="GPL-2 LGPL-2.1"
 # Bump FUDGE if a release is made which breaks ABI without changing SONAME.
 # (Reset to 0 if FUDGE != 0 if libgpgme/libgpgmepp/libqpggme change.)
 SLOT="1/11.6.15.2"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 IUSE="common-lisp static-libs +cxx python qt5 qt6 test"
 RESTRICT="!test? ( test )"
 REQUIRED_USE="
@@ -48,9 +48,16 @@ RDEPEND="
 	>=app-crypt/gnupg-2
 	>=dev-libs/libassuan-2.5.3:=
 	>=dev-libs/libgpg-error-1.46-r1:=
-	python? ( ${PYTHON_DEPS} )
+	cxx? ( !dev-cpp/gpgmepp )
+	python? (
+		!dev-python/gpgmepy
+		${PYTHON_DEPS}
+	)
 	qt5? ( dev-qt/qtcore:5 )
-	qt6? ( dev-qt/qtbase:6 )
+	qt6? (
+		!dev-libs/qgpgme
+		dev-qt/qtbase:6
+	)
 "
 DEPEND="
 	${RDEPEND}

sdk_container/src/third_party/portage-stable/app-crypt/gpgme/gpgme-2.0.0.ebuild

@@ -0,0 +1,90 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Maintainers should:
+# 1. Join the "Gentoo" project at https://dev.gnupg.org/project/view/27/
+# 2. Subscribe to release tasks like https://dev.gnupg.org/T6159
+# (find the one for the current release then subscribe to it +
+# any subsequent ones linked within so you're covered for a while.)
+
+# out-of-source b/c in-source builds are not supported:
+# * https://dev.gnupg.org/T6313#166339
+# * https://dev.gnupg.org/T6673#174545
+
+VERIFY_SIG_OPENPGP_KEY_PATH=/usr/share/openpgp-keys/gnupg.asc
+inherit libtool flag-o-matic out-of-source verify-sig
+
+DESCRIPTION="GnuPG Made Easy is a library for making GnuPG easier to use"
+HOMEPAGE="https://www.gnupg.org/related_software/gpgme"
+SRC_URI="
+	mirror://gnupg/gpgme/${P}.tar.bz2
+	verify-sig? ( mirror://gnupg/gpgme/${P}.tar.bz2.sig )
+"
+
+LICENSE="GPL-2 LGPL-2.1"
+# Please check ABI on each bump, even if SONAMEs didn't change: bug #833355
+# Subslot: SONAME of each: <libgpgme.FUDGE>
+SLOT="1/45.0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="common-lisp static-libs test"
+RESTRICT="!test? ( test )"
+
+RDEPEND="
+	>=app-crypt/gnupg-2
+	>=dev-libs/libassuan-2.5.3:=
+	>=dev-libs/libgpg-error-1.46-r1:=
+"
+DEPEND="${RDEPEND}"
+#doc? ( app-text/doxygen[dot] )
+BDEPEND="
+	verify-sig? ( sec-keys/openpgp-keys-gnupg )
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-1.18.0-tests-start-stop-agent-use-command-v.patch
+)
+
+src_prepare() {
+	default
+
+	elibtoolize
+
+	# bug #697456
+	addpredict /run/user/$(id -u)/gnupg
+
+	local MAX_WORKDIR=66
+	if use test && [[ "${#WORKDIR}" -gt "${MAX_WORKDIR}" ]]; then
+		eerror "Unable to run tests as WORKDIR='${WORKDIR}' is longer than ${MAX_WORKDIR} which causes failure!"
+		die "Could not run tests as requested with too-long WORKDIR."
+	fi
+
+	# Make best effort to allow longer PORTAGE_TMPDIR as usock limitation
+	# fails build/tests.
+	ln -s "${P}" "${WORKDIR}/b" || die
+	S="${WORKDIR}/b"
+}
+
+my_src_configure() {
+	# bug #847955
+	append-lfs-flags
+
+	local languages=(
+		$(usev common-lisp 'cl')
+	)
+
+	local myeconfargs=(
+		$(use test || echo "--disable-gpgconf-test --disable-gpg-test --disable-gpgsm-test --disable-g13-test")
+		--enable-languages="${languages[*]}"
+		$(use_enable static-libs static)
+		GPGRT_CONFIG="${ESYSROOT}/usr/bin/${CHOST}-gpgrt-config"
+	)
+
+	ECONF_SOURCE="${S}" econf "${myeconfargs[@]}"
+}
+
+my_src_install() {
+	emake DESTDIR="${D}" install
+	find "${ED}" -type f -name '*.la' -delete || die
+}

sdk_container/src/third_party/portage-stable/app-crypt/p11-kit/p11-kit-0.25.5.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 inherit bash-completion-r1 flag-o-matic meson-multilib python-any-r1
 
 DESCRIPTION="Provides a standard configuration setup for installing PKCS#11"

sdk_container/src/third_party/portage-stable/app-crypt/rhash/Manifest

@@ -1 +1,2 @@
 DIST rhash-1.4.5-src.tar.gz 444526 BLAKE2B 11021119e8af28e12491eabd55232e24a056bce79b624c970e4806c28fe707ea1395eb390572dba3453900d4512e5896d70642370d0c9340359e2fee95d62c8d SHA512 49bd6aa2497efc4871ae31eaca51d2dc78ceb7126311557d5280b14fafe9355eaecad37f0f78f865e4e1dd1aeb506d3301989cd2f9fff7b0091c81978e8c2f2e
+DIST rhash-1.4.6-src.tar.gz 461244 BLAKE2B 15ee0bc55745937a3e2f7d7e7b4193a19691e2678cdbc0a2caf19f16a7742100174e283edfef0449854fd24624e708078877643ce062c3babbc9b57992f73b81 SHA512 c125b71ec36cce2ec31057239cac8b987555f5e3b152dacb6386b905f8cc4d449c1de5b53e5a5206a2d87975681225c9b54e5826c10ffd91b3440f8595d22b15

sdk_container/src/third_party/portage-stable/app-crypt/rhash/rhash-1.4.6-r1.ebuild

@@ -0,0 +1,92 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit flag-o-matic toolchain-funcs multilib-minimal
+
+DESCRIPTION="Console utility and library for computing and verifying file hash sums"
+HOMEPAGE="https://rhash.sourceforge.net/"
+SRC_URI="https://downloads.sourceforge.net/${PN}/${P}-src.tar.gz"
+S="${WORKDIR}/RHash-${PV}"
+
+LICENSE="0BSD"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+IUSE="cpu_flags_x86_sha debug nls ssl static-libs"
+
+RDEPEND="
+	ssl? (
+		dev-libs/openssl:0=[${MULTILIB_USEDEP}]
+)"
+
+DEPEND="
+	${RDEPEND}
+"
+
+BDEPEND="
+	nls? ( sys-devel/gettext )
+"
+
+src_prepare() {
+	default
+
+	if [[ ${CHOST} == *-darwin* && ${CHOST##*darwin} -le 9 ]] ; then
+		# we lack posix_memalign
+		sed -i -e '/if _POSIX_VERSION/s/if .*$/if 0/' \
+			librhash/util.h || die
+	fi
+
+	# upstream fix for BSD and others, but was only applied for BSD
+	# we need support for Solaris, where we use a GNU toolchain, so use
+	# the original hack, hopefully next release has this fixed
+	# https://github.com/rhash/RHash/issues/238
+	if [[ ${CHOST} == *-solaris* ]] ; then
+		sed -i -e 's/^elif linux; then/else/' configure || die
+	fi
+
+	multilib_copy_sources
+}
+
+multilib_src_configure() {
+	append-ldflags $(test-flags-CCLD -Wl,--undefined-version)
+
+	set -- \
+		./configure \
+		--target="${CHOST}" \
+		--cc="$(tc-getCC)" \
+		--ar="$(tc-getAR)" \
+		--extra-cflags="${CFLAGS}" \
+		--extra-ldflags="${LDFLAGS}" \
+		--prefix="${EPREFIX}"/usr \
+		--libdir="${EPREFIX}"/usr/$(get_libdir) \
+		--sysconfdir="${EPREFIX}"/etc \
+		--disable-openssl-runtime \
+		--disable-static \
+		--enable-lib-shared \
+		$(usev !cpu_flags_x86_sha '--disable-shani') \
+		$(use_enable debug) \
+		$(use_enable nls gettext) \
+		$(use_enable ssl openssl) \
+		$(use_enable static-libs lib-static)
+
+	echo "${@}"
+	"${@}" || die "configure failed"
+}
+
+multilib_src_compile() {
+	emake all \
+		$(multilib_is_native_abi && use nls && echo compile-gmo)
+}
+
+multilib_src_install() {
+	# -j1 needed due to race condition.
+	emake DESTDIR="${D}" -j1 \
+		install{,-lib-headers,-pkg-config} \
+		$(multilib_is_native_abi && use nls && echo install-gmo) \
+		install-lib-so-link
+}
+
+multilib_src_test() {
+	emake test
+}

sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/Manifest

@@ -2,3 +2,4 @@ DIST eclass-manpages-20241115.tar.xz 456160 BLAKE2B eeaa4c964dbc784ae6351b89c4a8
 DIST eclass-manpages-20241117.tar.xz 456132 BLAKE2B 7111d9817b32ede80fb1e917f43e94b9342573684b715b874a2d880121840bbe67fa7c5aff95f5e7c99a25f2ae5beebadb3326c3a0df7117e99c0903cdcf3052 SHA512 73e28a2c40e89bbe2ba6611dc70c0b0320c8cf981b479ba3be86165d0b90c75f84c209d203d0ad612544709da881f7549d66560b4bccdb73209586d1a2cf8590
 DIST eclass-manpages-20241210.tar.xz 459680 BLAKE2B 076038d98bfae109ceaa1b14eff7f3e5ba575622243c60f59e7102d23d80e640c5e2932e2c614200cf3f653fc6cf4d0041dc4cc3011207273a690fc930e06091 SHA512 c3252f797ca71e9ca89b6d45715d763031733deb0f220aef65ddf750343693757f51d6535a22536b973c1c189b7cbe11306408c9c160e6ee3864e89af060ed8d
 DIST eclass-manpages-20250105.tar.xz 471540 BLAKE2B f21e783d233611349e036bb2e9ec52e3a8293891dcc56be15c628e9507b6bf5b650184eb7d57296a006f2a9764ac586257b61e1b810622bffff52c78708dfb9d SHA512 13c6ec0ad7251d287ba18dff6a362088c7e4f80036e225d1dc993cb467536566d88e588df0983207f26a06e39450c3072c436e391431df8d3e2b8a595a809022
+DIST eclass-manpages-20250506.tar.xz 483068 BLAKE2B e4c2aacd5e2b1416c9deb337a0b8d74b664b1f38e7f0555f812c25de494d8c18628f08e065738e6cfd2082769fc8367478a53849f1923d461027acca16f2a66a SHA512 99a361f0c4a144bf89f3dfdd02d298ef6c3a7138cd2b4e151449559fafaf6e83403ad73334494239c827bbc25eef30e701945b1783c9cc16aeff94fdf29679bb

sdk_container/src/third_party/portage-stable/app-doc/eclass-manpages/eclass-manpages-20250506.ebuild

@@ -0,0 +1,24 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+# Instructions to make a dist tarball:
+# git clone https://github.com/projg2/eclass-to-manpage.git
+# cd eclass-to-manpage
+# make dist ECLASSDIR=~/g/eclass/
+
+DESCRIPTION="Collection of Gentoo eclass manpages"
+HOMEPAGE="https://github.com/projg2/eclass-to-manpage"
+SRC_URI="https://dev.gentoo.org/~sam/distfiles/${CATEGORY}/${PN}/${P}.tar.xz"
+
+LICENSE="GPL-2"
+SLOT="0"
+# Keep the keywords stable. No need to change to ~arch.
+KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~x64-macos"
+
+BDEPEND="sys-apps/gawk"
+
+src_install() {
+	emake install DESTDIR="${D}" PREFIX="${EPREFIX}/usr"
+}

sdk_container/src/third_party/portage-stable/app-editors/nano/Manifest

@@ -1,2 +1,3 @@
 DIST nano-8.3.tar.xz 1681216 BLAKE2B 39c400483f79f11da0f959fed769462b65007f9235cb76d38e71d0a63919b659dc553d44f5d13dd13db801ec361fd7a3ad68b68bfa456ac6c169c861e80c6067 SHA512 9f57bb16a30240fdfc8fc31f5a55f681b80dd72de66fa143ef36c59ab696cc672d8fa054f5a4a547324db3deb2fe2f777cd7c1c023b571e2bb36c86a783ff1d6
 DIST nano-8.4.tar.xz 1691256 BLAKE2B 2e5dbe6982ef9d284c6e018abad593bf383f27c85047241bafaa098948b73897c0a81b63aa453385ac93afc1c398936464d5a1fb024d00936ad383c5e5e4403f SHA512 1b8258e341a8722114b24af9d4676fbd8a91dc3639786a81bcd192a7b4fbca87581ab8ebe49493dfb3599ae90b59f4df8ae2a4ee0c0c7ccec9a49b563c82f44a
+DIST nano-8.5.tar.xz 1707128 BLAKE2B 85de6d5349ed2332d41c054ff64979d7b00ec3c792564fcfb6ebed56b74a17c948117218a50297fead17674c06755afba393e73466eb2af9d3bb33af085c4f23 SHA512 d79562b2adbfe165e565b80ab4339e24f4a0ea464a97dfb7dce166df851b514c83e5071d89bee97759c0d6ff7d1fab1da97eaa0e742f3913d5c41a5539a3d8a1

sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.4.ebuild

@@ -9,7 +9,7 @@ if [[ ${PV} == 9999 ]] ; then
 else
 	MY_P="${PN}-${PV/_}"
 	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 ~hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 ~sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="GNU GPL'd Pico clone with more functionality"

sdk_container/src/third_party/portage-stable/app-editors/nano/nano-8.5.ebuild

@@ -0,0 +1,105 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+if [[ ${PV} == 9999 ]] ; then
+	EGIT_REPO_URI="https://git.savannah.gnu.org/git/nano.git"
+	inherit autotools git-r3
+else
+	MY_P="${PN}-${PV/_}"
+	SRC_URI="https://www.nano-editor.org/dist/v${PV:0:1}/${MY_P}.tar.xz"
+	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
+fi
+
+DESCRIPTION="GNU GPL'd Pico clone with more functionality"
+HOMEPAGE="https://www.nano-editor.org/ https://wiki.gentoo.org/wiki/Nano/Guide"
+
+LICENSE="GPL-3+ LGPL-2.1+ || ( GPL-3+ FDL-1.2+ )"
+SLOT="0"
+IUSE="debug justify magic minimal ncurses nls +spell unicode"
+
+RDEPEND="
+	>=sys-libs/ncurses-5.9-r1:=[unicode(+)?]
+	magic? ( sys-apps/file )
+	nls? ( virtual/libintl )
+"
+DEPEND="${RDEPEND}"
+BDEPEND="
+	nls? ( sys-devel/gettext )
+	virtual/pkgconfig
+"
+
+REQUIRED_USE="
+	magic? ( !minimal )
+"
+
+# gnulib FPs
+QA_CONFIG_IMPL_DECL_SKIP=( unreachable MIN static_assert )
+
+src_prepare() {
+	default
+
+	if [[ ${PV} == 9999 ]] ; then
+		eautoreconf
+	fi
+}
+
+src_configure() {
+	local myconfargs=(
+		--bindir="${EPREFIX}"/bin
+		--htmldir=/trash
+		$(use_enable !minimal color)
+		$(use_enable !minimal multibuffer)
+		$(use_enable !minimal nanorc)
+		$(use_enable magic libmagic)
+		$(use_enable spell speller)
+		$(use_enable justify)
+		$(use_enable debug)
+		$(use_enable nls)
+		$(use_enable unicode utf8)
+		$(use_enable minimal tiny)
+	)
+
+	econf "${myconfargs[@]}"
+}
+
+src_install() {
+	default
+
+	# Don't use "${ED}" here or things break (#654534)
+	rm -r "${D}"/trash || die
+
+	dodoc doc/sample.nanorc
+	docinto html
+	dodoc doc/faq.html
+	insinto /etc
+	newins doc/sample.nanorc nanorc
+
+	if ! use minimal ; then
+		# Enable colorization by default.
+		sed -i \
+			-e '/^# include /s:# *::' \
+			"${ED}"/etc/nanorc || die
+
+		# Since nano-5.0 these are no longer being "enabled" by default
+		# (bug #736848)
+		local rcdir="/usr/share/nano"
+		mv "${ED}"${rcdir}/extra/* "${ED}"/${rcdir}/ || die
+		rmdir "${ED}"${rcdir}/extra || die
+
+		insinto "${rcdir}"
+		newins "${FILESDIR}/gentoo.nanorc-r1" gentoo.nanorc
+	fi
+}
+
+pkg_postrm() {
+	[[ -n ${REPLACED_BY_VERSION} ]] && return
+
+	local e
+	e=$(unset EDITOR; . "${EROOT}"/etc/profile &>/dev/null; echo "${EDITOR}")
+	if [[ ${e##*/} == nano ]]; then
+		ewarn "The EDITOR variable is still set to ${e}."
+		ewarn "You can update it with \"eselect editor\"."
+	fi
+}

sdk_container/src/third_party/portage-stable/app-editors/nano/nano-9999.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8

sdk_container/src/third_party/portage-stable/app-editors/vim-core/Manifest

@@ -1,5 +1,4 @@
 DIST vim-9.0.2092-patches.tar.xz 2640 BLAKE2B 3a4b2bc57712de3b92b0e8d9b2d428e4d576665a183927051eddd53d019a5ca413c74dc10aff09917ee3120bd2e2ba441219d7238994f0d5ba14fc9c31180199 SHA512 ec27e4056460948ff86bc48a21de239a84b53757a8283144ec121654096796d970ad832234d6591a132bcd38bc12dc507cc7795a11cd383d20f08b4d9bcb051f
-DIST vim-9.0.2167.tar.gz 17405049 BLAKE2B 496c8f9672bc4ecce743a145bc2b671bf09034b2875e728406b318c8b12e2d8d4ee3423ce94f8749679f07d36f229954f7ef0b12ce7bc4d71ccf6637ce2d6029 SHA512 6a9a785b1915dc167210b0da4d5e4401c71ee49b3554c8a22566378658ddcc3493562897ea39035852399cc5ffb55a73355ab13390c27a4d00ffd76bcd10ddf0
-DIST vim-9.1.0366.tar.gz 17861209 BLAKE2B 8771f5ef6a966c1b5992a437dd6cf1de9525458f61a4cd8fa53737a7bde29a4da101668639a301288a266ee8b3911857d1ba5b4e88870b60473eb1eaa608d7a5 SHA512 11be2a6e349c7b6d26fc1943c35ea18c662baa4f30ae76936eefb30e0b4d988bfcaedf7ecd2c3903f64e23c75957f55b9bb4073e0f38c7eb10ef0ee0dc652ddb
-DIST vim-9.1.0470.tar.gz 17919981 BLAKE2B 90ebffc6e7b6162f8a047976659e044b75aaa946799b901e9f8c88f04a787543cde56545c8c6e5394fa2bc957d2e46810c5ca3f1315fc20a398a57bbdbc90f4c SHA512 41b71e9e5385237b30aa256f064c9d5c914b29a97c0ec562f1995ac5d476fcf840c3f0e9a52e599f6084777db147e83fcbf0ec6b985bb94c126264d4cbafb964
 DIST vim-9.1.0794.tar.gz 18235753 BLAKE2B 6ab377e6e0661ff8d4f0de2526b29b1c58c128babff662144425665582d390f772b9ded38ec21db4c32c4d68441b566500c434139f23f1ea79af8b7ecd693953 SHA512 38106d56c774b8f1dfed16953c07ff09c411bba5c7ab69e696ee9423dabdec9b0b405665fbd2411122f9963d3af8f9a259cc56b2954443ab41a14a8f2476624a
+DIST vim-9.1.1436.tar.gz 18860692 BLAKE2B ae0471654446ff4101f2df698f46c59c9d634336a6dd762732e46238e97bb6fd00a42b56cad3ae5cce572da2fc3cc65490cd10a024419940352fddd285bd6e23 SHA512 c6007fecf7e8ba2134246b0072ebfa8ce0f85666ac96a6ccc1a81e23a4e46a6b75c136823cdf6dccb6dfdf703affaede9ce83988cf8fe7e5542087a769e61961
+DIST vim-patches-vim-9.1.1432-patches.tar.bz2 2618 BLAKE2B fe7c302c71fbf66f1921e1b55e2f67914ed104ab86e2a6cf2e6bf67c98214f13f1d8ff1ed7015ec41a5665c692946e20ec5bdf4806e789a70e34c0c888472739 SHA512 a794a7e4d9014d5508db7b205404f5a4b44748a82c5599a26c1ec6b06d3105f6cebf9a93a058f65ad853bbadf432034fc8257a7c77b4f3446331b9d66c19b3af

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.2167-r1.ebuild

@@ -1,236 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with app-editors/vim and app-editors/gvim
-
-VIM_VERSION="9.0"
-VIM_PATCHES_VERSION="9.0.2092"
-inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
-
-if [[ ${PV} == 9999* ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/vim/vim.git"
-	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
-else
-	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-S="${WORKDIR}/vim-${PV}"
-
-DESCRIPTION="vim and gvim shared files"
-HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
-
-LICENSE="vim"
-SLOT="0"
-IUSE="nls acl minimal"
-
-# ncurses is only needed by ./configure, so no subslot operator required
-DEPEND=">=sys-libs/ncurses-5.2-r2:0"
-BDEPEND="dev-build/autoconf"
-
-if [[ ${PV} != 9999* ]]; then
-	# Gentoo patches to fix runtime issues, cross-compile errors, etc
-	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
-	)
-fi
-
-# platform-specific checks (bug #898406):
-# - acl()     -- Solaris
-# - statacl() -- AIX
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'acl'
-	'statacl'
-)
-
-pkg_setup() {
-	# people with broken alphabets run into trouble. bug #82186.
-	unset LANG LC_ALL
-	export LC_COLLATE="C"
-}
-
-src_prepare() {
-	default
-
-	# Fixup a script to use awk instead of nawk
-	sed -i \
-		-e '1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
-		"${S}"/runtime/tools/mve.awk || die "sed failed"
-
-	# See bug #77841. We remove this file after the tarball extraction.
-	rm -v "${S}"/runtime/tools/vimspell.sh || die "rm failed"
-
-	# Read vimrc and gvimrc from /etc/vim
-	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' >> "${S}"/src/feature.h || die
-	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' >> "${S}"/src/feature.h || die
-
-	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
-	# Hopefully this pattern won't break for a while at least.
-	# This fixes bug #29398 (27 Sep 2003 agriffis)
-	sed -i 's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
-		"${S}"/runtime/doc/syntax.txt \
-		"${S}"/runtime/doc/tagsrch.txt \
-		"${S}"/runtime/doc/usr_29.txt \
-		"${S}"/runtime/menu.vim \
-		"${S}"/src/configure.ac || die 'sed failed'
-
-	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
-	# correctly. To avoid some really entertaining error messages about stuff
-	# which isn't even in the source file being invalid, we'll do some trickery
-	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
-	find "${S}" -name '*.c' | while read c; do
-		echo >> "$c" || die "echo failed"
-	done
-
-	# Try to avoid sandbox problems. Bug #114475.
-	if [[ -d "${S}"/src/po ]]; then
-		sed -i -e \
-			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
-			"${S}"/src/po/Makefile || die "sed failed"
-	fi
-
-	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
-
-	# Fix bug #76331: -O3 causes problems, use -O2 instead. We'll do this for
-	# everyone since previous flag filtering bugs have turned out to affect
-	# multiple archs...
-	replace-flags -O3 -O2
-
-	# Fix bug #18245: Prevent "make" from the following chain:
-	# (1) Notice configure.ac is newer than auto/configure
-	# (2) Rebuild auto/configure
-	# (3) Notice auto/configure is newer than auto/config.mk
-	# (4) Run ./configure (with wrong args) to remake auto/config.mk
-	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
-
-	# Remove src/auto/configure file.
-	rm -v src/auto/configure || die "rm configure failed"
-
-	# bug 908961
-	if use elibc_musl ; then
-		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
-	fi
-}
-
-src_configure() {
-	# Fix bug #37354: Disallow -funroll-all-loops on amd64
-	# Bug 57859 suggests that we want to do this for all archs
-	filter-flags -funroll-all-loops
-
-	emake -j1 -C src autoconf
-
-	# This should fix a sandbox violation (see bug 24447). The hvc
-	# things are for ppc64, see bug 86433.
-	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
-		if [[ -e "${file}" ]]; then
-			addwrite ${file}
-		fi
-	done
-
-	# Let Portage do the stripping. Some people like that.
-	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
-
-	local myconf=(
-		--with-modified-by="Gentoo-${PVR} (RIP Bram)"
-		--enable-gui=no
-		--without-x
-		--disable-darwin
-		--disable-perlinterp
-		--disable-pythoninterp
-		--disable-rubyinterp
-		--disable-gpm
-		--disable-selinux
-		$(use_enable nls)
-		$(use_enable acl)
-	)
-
-	# Keep Gentoo Prefix env contained within the EPREFIX
-	use prefix && myconf+=( --without-local-dir )
-
-	if tc-is-cross-compiler ; then
-		export vim_cv_getcwd_broken=no \
-			   vim_cv_memmove_handles_overlap=yes \
-			   vim_cv_stat_ignores_slash=yes \
-			   vim_cv_terminfo=yes \
-			   vim_cv_toupper_broken=no
-	fi
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake -j1 -C src auto/osdef.h objects
-	emake tools
-}
-
-src_test() { :; }
-
-src_install() {
-	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
-
-	dodir /usr/{bin,share/{man/man1,vim}}
-	emake -C src \
-		installruntime \
-		installmanlinks \
-		installmacros \
-		installtutor \
-		installtutorbin \
-		installtools \
-		install-languages \
-		DESTDIR="${D}" \
-		BINDIR="${EPREFIX}"/usr/bin \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		DATADIR="${EPREFIX}"/usr/share
-
-	keepdir ${vimfiles}/keymap
-
-	# default vimrc is installed by vim-core since it applies to
-	# both vim and gvim
-	insinto /etc/vim/
-	newins "${FILESDIR}"/vimrc-r7 vimrc
-	eprefixify "${ED}"/etc/vim/vimrc
-
-	if use minimal; then
-		# To save space, install only a subset of the files.
-		# Helps minimalize the livecd, bug 65144.
-		rm -rv "${ED}${vimfiles}"/{compiler,doc,ftplugin,indent} || die
-		rm -rv "${ED}${vimfiles}"/{macros,print,tools,tutor} || die
-		rm -v "${ED}"/usr/bin/vimtutor || die
-
-		for f in "${ED}${vimfiles}"/colors/*.vim; do
-			if [[ ${f} != */@(default).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-
-		for f in "${ED}${vimfiles}"/syntax/*.vim; do
-			if [[ ${f} != */@(conf|crontab|fstab|inittab|resolv|sshdconfig|syntax|nosyntax|synload).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-	fi
-
-	newbashcomp "${FILESDIR}"/xxd-completion xxd
-
-	# install gvim icon since both vim/gvim desktop files reference it
-	doicon -s scalable "${FILESDIR}"/gvim.svg
-}
-
-pkg_postinst() {
-	# update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}
-
-pkg_postrm() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.0.2167.ebuild

@@ -1,236 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with app-editors/vim and app-editors/gvim
-
-VIM_VERSION="9.0"
-VIM_PATCHES_VERSION="9.0.2092"
-inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
-
-if [[ ${PV} == 9999* ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/vim/vim.git"
-	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
-else
-	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-S="${WORKDIR}/vim-${PV}"
-
-DESCRIPTION="vim and gvim shared files"
-HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
-
-LICENSE="vim"
-SLOT="0"
-IUSE="nls acl minimal"
-
-# ncurses is only needed by ./configure, so no subslot operator required
-DEPEND=">=sys-libs/ncurses-5.2-r2:0"
-BDEPEND="dev-build/autoconf"
-
-if [[ ${PV} != 9999* ]]; then
-	# Gentoo patches to fix runtime issues, cross-compile errors, etc
-	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
-	)
-fi
-
-# platform-specific checks (bug #898406):
-# - acl()     -- Solaris
-# - statacl() -- AIX
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'acl'
-	'statacl'
-)
-
-pkg_setup() {
-	# people with broken alphabets run into trouble. bug #82186.
-	unset LANG LC_ALL
-	export LC_COLLATE="C"
-}
-
-src_prepare() {
-	default
-
-	# Fixup a script to use awk instead of nawk
-	sed -i \
-		-e '1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
-		"${S}"/runtime/tools/mve.awk || die "sed failed"
-
-	# See bug #77841. We remove this file after the tarball extraction.
-	rm -v "${S}"/runtime/tools/vimspell.sh || die "rm failed"
-
-	# Read vimrc and gvimrc from /etc/vim
-	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' >> "${S}"/src/feature.h || die
-	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' >> "${S}"/src/feature.h || die
-
-	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
-	# Hopefully this pattern won't break for a while at least.
-	# This fixes bug #29398 (27 Sep 2003 agriffis)
-	sed -i 's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
-		"${S}"/runtime/doc/syntax.txt \
-		"${S}"/runtime/doc/tagsrch.txt \
-		"${S}"/runtime/doc/usr_29.txt \
-		"${S}"/runtime/menu.vim \
-		"${S}"/src/configure.ac || die 'sed failed'
-
-	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
-	# correctly. To avoid some really entertaining error messages about stuff
-	# which isn't even in the source file being invalid, we'll do some trickery
-	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
-	find "${S}" -name '*.c' | while read c; do
-		echo >> "$c" || die "echo failed"
-	done
-
-	# Try to avoid sandbox problems. Bug #114475.
-	if [[ -d "${S}"/src/po ]]; then
-		sed -i -e \
-			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
-			"${S}"/src/po/Makefile || die "sed failed"
-	fi
-
-	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
-
-	# Fix bug #76331: -O3 causes problems, use -O2 instead. We'll do this for
-	# everyone since previous flag filtering bugs have turned out to affect
-	# multiple archs...
-	replace-flags -O3 -O2
-
-	# Fix bug #18245: Prevent "make" from the following chain:
-	# (1) Notice configure.ac is newer than auto/configure
-	# (2) Rebuild auto/configure
-	# (3) Notice auto/configure is newer than auto/config.mk
-	# (4) Run ./configure (with wrong args) to remake auto/config.mk
-	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
-
-	# Remove src/auto/configure file.
-	rm -v src/auto/configure || die "rm configure failed"
-
-	# bug 908961
-	if use elibc_musl ; then
-		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
-	fi
-}
-
-src_configure() {
-	# Fix bug #37354: Disallow -funroll-all-loops on amd64
-	# Bug 57859 suggests that we want to do this for all archs
-	filter-flags -funroll-all-loops
-
-	emake -j1 -C src autoconf
-
-	# This should fix a sandbox violation (see bug 24447). The hvc
-	# things are for ppc64, see bug 86433.
-	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
-		if [[ -e "${file}" ]]; then
-			addwrite ${file}
-		fi
-	done
-
-	# Let Portage do the stripping. Some people like that.
-	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
-
-	local myconf=(
-		--with-modified-by="Gentoo-${PVR} (RIP Bram)"
-		--enable-gui=no
-		--without-x
-		--disable-darwin
-		--disable-perlinterp
-		--disable-pythoninterp
-		--disable-rubyinterp
-		--disable-gpm
-		--disable-selinux
-		$(use_enable nls)
-		$(use_enable acl)
-	)
-
-	# Keep Gentoo Prefix env contained within the EPREFIX
-	use prefix && myconf+=( --without-local-dir )
-
-	if tc-is-cross-compiler ; then
-		export vim_cv_getcwd_broken=no \
-			   vim_cv_memmove_handles_overlap=yes \
-			   vim_cv_stat_ignores_slash=yes \
-			   vim_cv_terminfo=yes \
-			   vim_cv_toupper_broken=no
-	fi
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake -j1 -C src auto/osdef.h objects
-	emake tools
-}
-
-src_test() { :; }
-
-src_install() {
-	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
-
-	dodir /usr/{bin,share/{man/man1,vim}}
-	emake -C src \
-		installruntime \
-		installmanlinks \
-		installmacros \
-		installtutor \
-		installtutorbin \
-		installtools \
-		install-languages \
-		DESTDIR="${D}" \
-		BINDIR="${EPREFIX}"/usr/bin \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		DATADIR="${EPREFIX}"/usr/share
-
-	keepdir ${vimfiles}/keymap
-
-	# default vimrc is installed by vim-core since it applies to
-	# both vim and gvim
-	insinto /etc/vim/
-	newins "${FILESDIR}"/vimrc-r6 vimrc
-	eprefixify "${ED}"/etc/vim/vimrc
-
-	if use minimal; then
-		# To save space, install only a subset of the files.
-		# Helps minimalize the livecd, bug 65144.
-		rm -rv "${ED}${vimfiles}"/{compiler,doc,ftplugin,indent} || die
-		rm -rv "${ED}${vimfiles}"/{macros,print,tools,tutor} || die
-		rm -v "${ED}"/usr/bin/vimtutor || die
-
-		for f in "${ED}${vimfiles}"/colors/*.vim; do
-			if [[ ${f} != */@(default).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-
-		for f in "${ED}${vimfiles}"/syntax/*.vim; do
-			if [[ ${f} != */@(conf|crontab|fstab|inittab|resolv|sshdconfig|syntax|nosyntax|synload).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-	fi
-
-	newbashcomp "${FILESDIR}"/xxd-completion xxd
-
-	# install gvim icon since both vim/gvim desktop files reference it
-	doicon -s scalable "${FILESDIR}"/gvim.svg
-}
-
-pkg_postinst() {
-	# update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}
-
-pkg_postrm() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.0366-r1.ebuild

@@ -1,236 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with app-editors/vim and app-editors/gvim
-
-VIM_VERSION="9.1"
-VIM_PATCHES_VERSION="9.0.2092"
-inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
-
-if [[ ${PV} == 9999* ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/vim/vim.git"
-	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
-else
-	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-S="${WORKDIR}/vim-${PV}"
-
-DESCRIPTION="vim and gvim shared files"
-HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
-
-LICENSE="vim"
-SLOT="0"
-IUSE="nls acl minimal"
-
-# ncurses is only needed by ./configure, so no subslot operator required
-DEPEND=">=sys-libs/ncurses-5.2-r2:0"
-BDEPEND="dev-build/autoconf"
-
-if [[ ${PV} != 9999* ]]; then
-	# Gentoo patches to fix runtime issues, cross-compile errors, etc
-	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
-	)
-fi
-
-# platform-specific checks (bug #898406):
-# - acl()     -- Solaris
-# - statacl() -- AIX
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'acl'
-	'statacl'
-)
-
-pkg_setup() {
-	# people with broken alphabets run into trouble. bug #82186.
-	unset LANG LC_ALL
-	export LC_COLLATE="C"
-}
-
-src_prepare() {
-	default
-
-	# Fixup a script to use awk instead of nawk
-	sed -i \
-		-e '1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
-		"${S}"/runtime/tools/mve.awk || die "sed failed"
-
-	# See bug #77841. We remove this file after the tarball extraction.
-	rm -v "${S}"/runtime/tools/vimspell.sh || die "rm failed"
-
-	# Read vimrc and gvimrc from /etc/vim
-	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' >> "${S}"/src/feature.h || die
-	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' >> "${S}"/src/feature.h || die
-
-	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
-	# Hopefully this pattern won't break for a while at least.
-	# This fixes bug #29398 (27 Sep 2003 agriffis)
-	sed -i 's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
-		"${S}"/runtime/doc/syntax.txt \
-		"${S}"/runtime/doc/tagsrch.txt \
-		"${S}"/runtime/doc/usr_29.txt \
-		"${S}"/runtime/menu.vim \
-		"${S}"/src/configure.ac || die 'sed failed'
-
-	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
-	# correctly. To avoid some really entertaining error messages about stuff
-	# which isn't even in the source file being invalid, we'll do some trickery
-	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
-	find "${S}" -name '*.c' | while read c; do
-		echo >> "$c" || die "echo failed"
-	done
-
-	# Try to avoid sandbox problems. Bug #114475.
-	if [[ -d "${S}"/src/po ]]; then
-		sed -i -e \
-			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
-			"${S}"/src/po/Makefile || die "sed failed"
-	fi
-
-	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
-
-	# Fix bug #76331: -O3 causes problems, use -O2 instead. We'll do this for
-	# everyone since previous flag filtering bugs have turned out to affect
-	# multiple archs...
-	replace-flags -O3 -O2
-
-	# Fix bug #18245: Prevent "make" from the following chain:
-	# (1) Notice configure.ac is newer than auto/configure
-	# (2) Rebuild auto/configure
-	# (3) Notice auto/configure is newer than auto/config.mk
-	# (4) Run ./configure (with wrong args) to remake auto/config.mk
-	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
-
-	# Remove src/auto/configure file.
-	rm -v src/auto/configure || die "rm configure failed"
-
-	# bug 908961
-	if use elibc_musl ; then
-		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
-	fi
-}
-
-src_configure() {
-	# Fix bug #37354: Disallow -funroll-all-loops on amd64
-	# Bug 57859 suggests that we want to do this for all archs
-	filter-flags -funroll-all-loops
-
-	emake -j1 -C src autoconf
-
-	# This should fix a sandbox violation (see bug 24447). The hvc
-	# things are for ppc64, see bug 86433.
-	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
-		if [[ -e "${file}" ]]; then
-			addwrite ${file}
-		fi
-	done
-
-	# Let Portage do the stripping. Some people like that.
-	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
-
-	local myconf=(
-		--with-modified-by="Gentoo-${PVR} (RIP Bram)"
-		--enable-gui=no
-		--without-x
-		--disable-darwin
-		--disable-perlinterp
-		--disable-pythoninterp
-		--disable-rubyinterp
-		--disable-gpm
-		--disable-selinux
-		$(use_enable nls)
-		$(use_enable acl)
-	)
-
-	# Keep Gentoo Prefix env contained within the EPREFIX
-	use prefix && myconf+=( --without-local-dir )
-
-	if tc-is-cross-compiler ; then
-		export vim_cv_getcwd_broken=no \
-			   vim_cv_memmove_handles_overlap=yes \
-			   vim_cv_stat_ignores_slash=yes \
-			   vim_cv_terminfo=yes \
-			   vim_cv_toupper_broken=no
-	fi
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake -j1 -C src auto/osdef.h objects
-	emake tools
-}
-
-src_test() { :; }
-
-src_install() {
-	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
-
-	dodir /usr/{bin,share/{man/man1,vim}}
-	emake -C src \
-		installruntime \
-		installmanlinks \
-		installmacros \
-		installtutor \
-		installtutorbin \
-		installtools \
-		install-languages \
-		DESTDIR="${D}" \
-		BINDIR="${EPREFIX}"/usr/bin \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		DATADIR="${EPREFIX}"/usr/share
-
-	keepdir ${vimfiles}/keymap
-
-	# default vimrc is installed by vim-core since it applies to
-	# both vim and gvim
-	insinto /etc/vim/
-	newins "${FILESDIR}"/vimrc-r7 vimrc
-	eprefixify "${ED}"/etc/vim/vimrc
-
-	if use minimal; then
-		# To save space, install only a subset of the files.
-		# Helps minimalize the livecd, bug 65144.
-		rm -rv "${ED}${vimfiles}"/{compiler,doc,ftplugin,indent} || die
-		rm -rv "${ED}${vimfiles}"/{macros,print,tools,tutor} || die
-		rm -v "${ED}"/usr/bin/vimtutor || die
-
-		for f in "${ED}${vimfiles}"/colors/*.vim; do
-			if [[ ${f} != */@(default).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-
-		for f in "${ED}${vimfiles}"/syntax/*.vim; do
-			if [[ ${f} != */@(conf|crontab|fstab|inittab|resolv|sshdconfig|syntax|nosyntax|synload).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-	fi
-
-	newbashcomp "${FILESDIR}"/xxd-completion xxd
-
-	# install gvim icon since both vim/gvim desktop files reference it
-	doicon -s scalable "${FILESDIR}"/gvim.svg
-}
-
-pkg_postinst() {
-	# update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}
-
-pkg_postrm() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.0366.ebuild

@@ -1,236 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with app-editors/vim and app-editors/gvim
-
-VIM_VERSION="9.1"
-VIM_PATCHES_VERSION="9.0.2092"
-inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
-
-if [[ ${PV} == 9999* ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/vim/vim.git"
-	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
-else
-	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-S="${WORKDIR}/vim-${PV}"
-
-DESCRIPTION="vim and gvim shared files"
-HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
-
-LICENSE="vim"
-SLOT="0"
-IUSE="nls acl minimal"
-
-# ncurses is only needed by ./configure, so no subslot operator required
-DEPEND=">=sys-libs/ncurses-5.2-r2:0"
-BDEPEND="dev-build/autoconf"
-
-if [[ ${PV} != 9999* ]]; then
-	# Gentoo patches to fix runtime issues, cross-compile errors, etc
-	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
-	)
-fi
-
-# platform-specific checks (bug #898406):
-# - acl()     -- Solaris
-# - statacl() -- AIX
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'acl'
-	'statacl'
-)
-
-pkg_setup() {
-	# people with broken alphabets run into trouble. bug #82186.
-	unset LANG LC_ALL
-	export LC_COLLATE="C"
-}
-
-src_prepare() {
-	default
-
-	# Fixup a script to use awk instead of nawk
-	sed -i \
-		-e '1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
-		"${S}"/runtime/tools/mve.awk || die "sed failed"
-
-	# See bug #77841. We remove this file after the tarball extraction.
-	rm -v "${S}"/runtime/tools/vimspell.sh || die "rm failed"
-
-	# Read vimrc and gvimrc from /etc/vim
-	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' >> "${S}"/src/feature.h || die
-	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' >> "${S}"/src/feature.h || die
-
-	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
-	# Hopefully this pattern won't break for a while at least.
-	# This fixes bug #29398 (27 Sep 2003 agriffis)
-	sed -i 's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
-		"${S}"/runtime/doc/syntax.txt \
-		"${S}"/runtime/doc/tagsrch.txt \
-		"${S}"/runtime/doc/usr_29.txt \
-		"${S}"/runtime/menu.vim \
-		"${S}"/src/configure.ac || die 'sed failed'
-
-	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
-	# correctly. To avoid some really entertaining error messages about stuff
-	# which isn't even in the source file being invalid, we'll do some trickery
-	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
-	find "${S}" -name '*.c' | while read c; do
-		echo >> "$c" || die "echo failed"
-	done
-
-	# Try to avoid sandbox problems. Bug #114475.
-	if [[ -d "${S}"/src/po ]]; then
-		sed -i -e \
-			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
-			"${S}"/src/po/Makefile || die "sed failed"
-	fi
-
-	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
-
-	# Fix bug #76331: -O3 causes problems, use -O2 instead. We'll do this for
-	# everyone since previous flag filtering bugs have turned out to affect
-	# multiple archs...
-	replace-flags -O3 -O2
-
-	# Fix bug #18245: Prevent "make" from the following chain:
-	# (1) Notice configure.ac is newer than auto/configure
-	# (2) Rebuild auto/configure
-	# (3) Notice auto/configure is newer than auto/config.mk
-	# (4) Run ./configure (with wrong args) to remake auto/config.mk
-	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
-
-	# Remove src/auto/configure file.
-	rm -v src/auto/configure || die "rm configure failed"
-
-	# bug 908961
-	if use elibc_musl ; then
-		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
-	fi
-}
-
-src_configure() {
-	# Fix bug #37354: Disallow -funroll-all-loops on amd64
-	# Bug 57859 suggests that we want to do this for all archs
-	filter-flags -funroll-all-loops
-
-	emake -j1 -C src autoconf
-
-	# This should fix a sandbox violation (see bug 24447). The hvc
-	# things are for ppc64, see bug 86433.
-	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
-		if [[ -e "${file}" ]]; then
-			addwrite ${file}
-		fi
-	done
-
-	# Let Portage do the stripping. Some people like that.
-	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
-
-	local myconf=(
-		--with-modified-by="Gentoo-${PVR} (RIP Bram)"
-		--enable-gui=no
-		--without-x
-		--disable-darwin
-		--disable-perlinterp
-		--disable-pythoninterp
-		--disable-rubyinterp
-		--disable-gpm
-		--disable-selinux
-		$(use_enable nls)
-		$(use_enable acl)
-	)
-
-	# Keep Gentoo Prefix env contained within the EPREFIX
-	use prefix && myconf+=( --without-local-dir )
-
-	if tc-is-cross-compiler ; then
-		export vim_cv_getcwd_broken=no \
-			   vim_cv_memmove_handles_overlap=yes \
-			   vim_cv_stat_ignores_slash=yes \
-			   vim_cv_terminfo=yes \
-			   vim_cv_toupper_broken=no
-	fi
-
-	econf "${myconf[@]}"
-}
-
-src_compile() {
-	emake -j1 -C src auto/osdef.h objects
-	emake tools
-}
-
-src_test() { :; }
-
-src_install() {
-	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
-
-	dodir /usr/{bin,share/{man/man1,vim}}
-	emake -C src \
-		installruntime \
-		installmanlinks \
-		installmacros \
-		installtutor \
-		installtutorbin \
-		installtools \
-		install-languages \
-		DESTDIR="${D}" \
-		BINDIR="${EPREFIX}"/usr/bin \
-		MANDIR="${EPREFIX}"/usr/share/man \
-		DATADIR="${EPREFIX}"/usr/share
-
-	keepdir ${vimfiles}/keymap
-
-	# default vimrc is installed by vim-core since it applies to
-	# both vim and gvim
-	insinto /etc/vim/
-	newins "${FILESDIR}"/vimrc-r6 vimrc
-	eprefixify "${ED}"/etc/vim/vimrc
-
-	if use minimal; then
-		# To save space, install only a subset of the files.
-		# Helps minimalize the livecd, bug 65144.
-		rm -rv "${ED}${vimfiles}"/{compiler,doc,ftplugin,indent} || die
-		rm -rv "${ED}${vimfiles}"/{macros,print,tools,tutor} || die
-		rm -v "${ED}"/usr/bin/vimtutor || die
-
-		for f in "${ED}${vimfiles}"/colors/*.vim; do
-			if [[ ${f} != */@(default).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-
-		for f in "${ED}${vimfiles}"/syntax/*.vim; do
-			if [[ ${f} != */@(conf|crontab|fstab|inittab|resolv|sshdconfig|syntax|nosyntax|synload).vim ]] ; then
-				printf '%s\0' "${f}"
-			fi
-		done | xargs -0 rm -f || die
-	fi
-
-	newbashcomp "${FILESDIR}"/xxd-completion xxd
-
-	# install gvim icon since both vim/gvim desktop files reference it
-	doicon -s scalable "${FILESDIR}"/gvim.svg
-}
-
-pkg_postinst() {
-	# update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}
-
-pkg_postrm() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# update icon cache
-	xdg_icon_cache_update
-}

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.0794.ebuild

@@ -18,10 +18,10 @@ else
 		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
 	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
-S="${WORKDIR}/vim-${PV}"
 
 DESCRIPTION="vim and gvim shared files"
 HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+S="${WORKDIR}/vim-${PV}"
 
 LICENSE="vim"
 SLOT="0"

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9.1.1436.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,7 +6,7 @@ EAPI=8
 # Please bump with app-editors/vim and app-editors/gvim
 
 VIM_VERSION="9.1"
-VIM_PATCHES_VERSION="9.0.2092"
+VIM_PATCHES_VERSION="9.1.1432"
 inherit bash-completion-r1 desktop flag-o-matic prefix toolchain-funcs vim-doc xdg-utils
 
 if [[ ${PV} == 9999* ]] ; then
@@ -15,13 +15,14 @@ if [[ ${PV} == 9999* ]] ; then
 	EGIT_CHECKOUT_DIR=${WORKDIR}/vim-${PV}
 else
 	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> vim-${PV}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
+		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
+		# https://github.com/douglarek/gentoo-vim-patches/releases/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.gz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
-S="${WORKDIR}/vim-${PV}"
 
 DESCRIPTION="vim and gvim shared files"
 HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+S="${WORKDIR}/vim-${PV}"
 
 LICENSE="vim"
 SLOT="0"
@@ -34,7 +35,7 @@ BDEPEND="dev-build/autoconf"
 if [[ ${PV} != 9999* ]]; then
 	# Gentoo patches to fix runtime issues, cross-compile errors, etc
 	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
+		"${WORKDIR}/vim-patches-vim-${VIM_PATCHES_VERSION}-patches"
 	)
 fi
 

sdk_container/src/third_party/portage-stable/app-editors/vim-core/vim-core-9999.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -18,10 +18,10 @@ else
 		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 fi
-S="${WORKDIR}/vim-${PV}"
 
 DESCRIPTION="vim and gvim shared files"
 HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
+S="${WORKDIR}/vim-${PV}"
 
 LICENSE="vim"
 SLOT="0"

sdk_container/src/third_party/portage-stable/app-editors/vim/Manifest

@@ -1,5 +1,4 @@
 DIST vim-9.0.2092-patches.tar.xz 2640 BLAKE2B 3a4b2bc57712de3b92b0e8d9b2d428e4d576665a183927051eddd53d019a5ca413c74dc10aff09917ee3120bd2e2ba441219d7238994f0d5ba14fc9c31180199 SHA512 ec27e4056460948ff86bc48a21de239a84b53757a8283144ec121654096796d970ad832234d6591a132bcd38bc12dc507cc7795a11cd383d20f08b4d9bcb051f
-DIST vim-9.0.2167.tar.gz 17405049 BLAKE2B 496c8f9672bc4ecce743a145bc2b671bf09034b2875e728406b318c8b12e2d8d4ee3423ce94f8749679f07d36f229954f7ef0b12ce7bc4d71ccf6637ce2d6029 SHA512 6a9a785b1915dc167210b0da4d5e4401c71ee49b3554c8a22566378658ddcc3493562897ea39035852399cc5ffb55a73355ab13390c27a4d00ffd76bcd10ddf0
-DIST vim-9.1.0366.tar.gz 17861209 BLAKE2B 8771f5ef6a966c1b5992a437dd6cf1de9525458f61a4cd8fa53737a7bde29a4da101668639a301288a266ee8b3911857d1ba5b4e88870b60473eb1eaa608d7a5 SHA512 11be2a6e349c7b6d26fc1943c35ea18c662baa4f30ae76936eefb30e0b4d988bfcaedf7ecd2c3903f64e23c75957f55b9bb4073e0f38c7eb10ef0ee0dc652ddb
-DIST vim-9.1.0470.tar.gz 17919981 BLAKE2B 90ebffc6e7b6162f8a047976659e044b75aaa946799b901e9f8c88f04a787543cde56545c8c6e5394fa2bc957d2e46810c5ca3f1315fc20a398a57bbdbc90f4c SHA512 41b71e9e5385237b30aa256f064c9d5c914b29a97c0ec562f1995ac5d476fcf840c3f0e9a52e599f6084777db147e83fcbf0ec6b985bb94c126264d4cbafb964
 DIST vim-9.1.0794.tar.gz 18235753 BLAKE2B 6ab377e6e0661ff8d4f0de2526b29b1c58c128babff662144425665582d390f772b9ded38ec21db4c32c4d68441b566500c434139f23f1ea79af8b7ecd693953 SHA512 38106d56c774b8f1dfed16953c07ff09c411bba5c7ab69e696ee9423dabdec9b0b405665fbd2411122f9963d3af8f9a259cc56b2954443ab41a14a8f2476624a
+DIST vim-9.1.1436.tar.gz 18860692 BLAKE2B ae0471654446ff4101f2df698f46c59c9d634336a6dd762732e46238e97bb6fd00a42b56cad3ae5cce572da2fc3cc65490cd10a024419940352fddd285bd6e23 SHA512 c6007fecf7e8ba2134246b0072ebfa8ce0f85666ac96a6ccc1a81e23a4e46a6b75c136823cdf6dccb6dfdf703affaede9ce83988cf8fe7e5542087a769e61961
+DIST vim-patches-vim-9.1.1432-patches.tar.bz2 2618 BLAKE2B fe7c302c71fbf66f1921e1b55e2f67914ed104ab86e2a6cf2e6bf67c98214f13f1d8ff1ed7015ec41a5665c692946e20ec5bdf4806e789a70e34c0c888472739 SHA512 a794a7e4d9014d5508db7b205404f5a4b44748a82c5599a26c1ec6b06d3105f6cebf9a93a058f65ad853bbadf432034fc8257a7c77b4f3446331b9d66c19b3af

sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.0.2167.ebuild

@@ -1,377 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with app-editors/vim-core and app-editors/gvim
-
-VIM_VERSION="9.0"
-VIM_PATCHES_VERSION="9.0.2092"
-
-LUA_COMPAT=( lua5-{1..4} luajit )
-PYTHON_COMPAT=( python3_{10..12} )
-PYTHON_REQ_USE="threads(+)"
-USE_RUBY="ruby31 ruby32"
-
-inherit vim-doc flag-o-matic bash-completion-r1 lua-single python-single-r1 ruby-single toolchain-funcs desktop xdg-utils
-
-if [[ ${PV} == 9999* ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/vim/vim.git"
-else
-	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-DESCRIPTION="Vim, an improved vi-style text editor"
-HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
-
-LICENSE="vim"
-SLOT="0"
-IUSE="X acl crypt cscope debug gpm lua minimal nls perl python racket ruby selinux sound tcl terminal vim-pager"
-REQUIRED_USE="
-	lua? ( ${LUA_REQUIRED_USE} )
-	python? ( ${PYTHON_REQUIRED_USE} )
-	vim-pager? ( !minimal )
-"
-
-RDEPEND="
-	>=app-eselect/eselect-vi-1.1
-	>=sys-libs/ncurses-5.2-r2:0=
-	nls? ( virtual/libintl )
-	acl? ( kernel_linux? ( sys-apps/acl ) )
-	crypt? ( dev-libs/libsodium:= )
-	cscope? ( dev-util/cscope )
-	gpm? ( >=sys-libs/gpm-1.19.3 )
-	lua? ( ${LUA_DEPS}
-		$(lua_gen_impl_dep 'deprecated' lua5-1)
-	)
-	~app-editors/vim-core-${PV}
-	vim-pager? ( app-editors/vim-core[-minimal] )
-	perl? ( dev-lang/perl:= )
-	python? ( ${PYTHON_DEPS} )
-	racket? ( dev-scheme/racket )
-	ruby? ( ${RUBY_DEPS} )
-	selinux? ( sys-libs/libselinux )
-	sound? ( media-libs/libcanberra )
-	tcl? ( dev-lang/tcl:0= )
-	X? ( x11-libs/libXt )
-"
-DEPEND="${RDEPEND}
-	X? ( x11-base/xorg-proto )
-"
-# configure runs the Lua interpreter
-BDEPEND="
-	dev-build/autoconf
-	lua? ( ${LUA_DEPS} )
-	nls? ( sys-devel/gettext )
-"
-PDEPEND="!minimal? ( app-vim/gentoo-syntax )"
-
-if [[ ${PV} != 9999* ]]; then
-	# Gentoo patches to fix runtime issues, cross-compile errors, etc
-	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
-	)
-fi
-
-# platform-specific checks (bug #898452):
-# - acl()     -- Solaris
-# - statacl() -- AIX
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'acl'
-	'statacl'
-)
-
-pkg_setup() {
-	# people with broken alphabets run into trouble. bug #82186.
-	unset LANG LC_ALL
-	export LC_COLLATE="C"
-
-	use lua && lua-single_pkg_setup
-	use python && python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Fixup a script to use awk instead of nawk
-	sed -i -e \
-		'1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
-		"${S}"/runtime/tools/mve.awk || die "mve.awk sed failed"
-
-	# Read vimrc and gvimrc from /etc/vim
-	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' \
-		>> "${S}"/src/feature.h || die "echo failed"
-	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' \
-		>> "${S}"/src/feature.h || die "echo failed"
-
-	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
-	# Hopefully this pattern won't break for a while at least.
-	# This fixes bug #29398 (27 Sep 2003 agriffis)
-	sed -i -e \
-		's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
-		"${S}"/runtime/doc/syntax.txt \
-		"${S}"/runtime/doc/tagsrch.txt \
-		"${S}"/runtime/doc/usr_29.txt \
-		"${S}"/runtime/menu.vim \
-		"${S}"/src/configure.ac || die 'sed failed'
-
-	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
-	# correctly. To avoid some really entertaining error messages about stuff
-	# which isn't even in the source file being invalid, we'll do some trickery
-	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
-	find "${S}" -name '*.c' | while read c; do
-		echo >> "$c" || die "echo failed"
-	done
-
-	# conditionally make the manpager.sh script
-	if use vim-pager; then
-		cat > "${S}"/runtime/macros/manpager.sh <<-_EOF_ || die "cat EOF failed"
-			#!/bin/sh
-			sed -e 's/\x1B\[[[:digit:]]\+m//g' | col -b | \\
-					vim \\
-						-c 'let no_plugin_maps = 1' \\
-						-c 'set nolist nomod ft=man ts=8' \\
-						-c 'let g:showmarks_enable=0' \\
-						-c 'runtime! macros/less.vim' -
-			_EOF_
-	fi
-
-	# Try to avoid sandbox problems. Bug #114475.
-	if [[ -d "${S}"/src/po ]]; then
-		sed -i -e \
-			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
-			"${S}"/src/po/Makefile || die "sed failed"
-	fi
-
-	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
-
-	# Fix bug 18245: Prevent "make" from the following chain:
-	# (1) Notice configure.ac is newer than auto/configure
-	# (2) Rebuild auto/configure
-	# (3) Notice auto/configure is newer than auto/config.mk
-	# (4) Run ./configure (with wrong args) to remake auto/config.mk
-	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
-	rm src/auto/configure || die "rm failed"
-
-	# bug 908961
-	if use elibc_musl ; then
-		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
-	fi
-}
-
-src_configure() {
-
-	# Fix bug #37354: Disallow -funroll-all-loops on amd64
-	# Bug #57859 suggests that we want to do this for all archs
-	filter-flags -funroll-all-loops
-
-	# Fix bug 76331: -O3 causes problems, use -O2 instead. We'll do this for
-	# everyone since previous flag filtering bugs have turned out to affect
-	# multiple archs...
-	replace-flags -O3 -O2
-
-	emake -j1 -C src autoconf
-
-	# This should fix a sandbox violation (see bug #24447). The hvc
-	# things are for ppc64, see bug #86433.
-	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
-		if [[ -e "${file}" ]]; then
-			addwrite ${file}
-		fi
-	done
-
-	local myconf=()
-	if use minimal; then
-		myconf=(
-			--with-features=tiny
-			--disable-nls
-			--disable-canberra
-			--disable-acl
-			--enable-gui=no
-			--without-x
-			--disable-darwin
-			--disable-luainterp
-			--disable-perlinterp
-			--disable-pythoninterp
-			--disable-mzschemeinterp
-			--disable-rubyinterp
-			--disable-selinux
-			--disable-tclinterp
-			--disable-gpm
-		)
-	else
-		use debug && append-flags "-DDEBUG"
-
-		myconf=(
-			--with-features=huge
-			$(use_enable sound canberra)
-			$(use_enable acl)
-			$(use_enable crypt libsodium)
-			$(use_enable cscope)
-			$(use_enable gpm)
-			$(use_enable nls)
-			$(use_enable perl perlinterp)
-			$(use_enable python python3interp)
-			$(use_with python python3-command "${PYTHON}")
-			$(use_enable racket mzschemeinterp)
-			$(use_enable ruby rubyinterp)
-			$(use_enable selinux)
-			$(use_enable tcl tclinterp)
-			$(use_enable terminal)
-		)
-
-		# --with-features=huge forces on cscope even if we --disable it. We need
-		# to sed this out to avoid screwiness. (1 Sep 2004 ciaranm)
-		if ! use cscope; then
-			sed -i -e \
-				'/# define FEAT_CSCOPE/d' src/feature.h || die "sed failed"
-		fi
-
-		if use lua; then
-			# -DLUA_COMPAT_OPENLIB=1 is required to enable the
-			# deprecated (in 5.1) luaL_openlib API (#874690)
-			use lua_single_target_lua5-1 && append-cppflags -DLUA_COMPAT_OPENLIB=1
-
-			myconf+=(
-				--enable-luainterp
-				$(use_with lua_single_target_luajit luajit)
-				--with-lua-prefix="${EPREFIX}/usr"
-			)
-		fi
-
-		# don't test USE=X here ... see bug #19115
-		# but need to provide a way to link against X ... see bug #20093
-		myconf+=(
-			--enable-gui=no
-			--disable-darwin
-			$(use_with X x)
-		)
-	fi
-
-	# let package manager strip binaries
-	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
-
-	# keep prefix env contained within the EPREFIX
-	use prefix && myconf+=( --without-local-dir )
-
-	if tc-is-cross-compiler ; then
-		export vim_cv_getcwd_broken=no \
-			   vim_cv_memmove_handles_overlap=yes \
-			   vim_cv_stat_ignores_slash=yes \
-			   vim_cv_terminfo=yes \
-			   vim_cv_toupper_broken=no
-	fi
-
-	econf \
-		--with-modified-by="Gentoo-${PVR} (RIP Bram)" \
-		"${myconf[@]}"
-}
-
-src_compile() {
-	# The following allows emake to be used
-	emake -j1 -C src auto/osdef.h objects
-
-	emake
-}
-
-src_test() {
-	einfo
-	einfo "Starting vim tests. Several error messages will be shown"
-	einfo "while the tests run. This is normal behaviour and does not"
-	einfo "indicate a fault."
-	einfo
-	ewarn "If the tests fail, your terminal may be left in a strange"
-	ewarn "state. Usually, running 'reset' will fix this."
-	einfo
-
-	# Don't let vim talk to X
-	unset DISPLAY
-
-	# Arch and opensuse seem to do this and at this point, I'm willing
-	# to try anything to avoid random test hangs!
-	export TERM=xterm
-
-	# See https://github.com/vim/vim/blob/f08b0eb8691ff09f98bc4beef986ece1c521655f/src/testdir/runtest.vim#L5
-	# for more information on test variables we can use.
-	# Note that certain variables need vim-compatible regex (not PCRE), see e.g.
-	# http://www.softpanorama.org/Editors/Vimorama/vim_regular_expressions.shtml.
-	#
-	# Skipped tests:
-	# - Test_expand_star_star
-	# Hangs because of a recursive symlink in /usr/include/nodejs (bug #616680)
-	# - Test_exrc
-	# Looks in wrong location? (bug #742710)
-	# - Test_job_tty_in_out
-	# Fragile and depends on TERM(?)
-	# - Test_spelldump_bang
-	# Hangs.
-	# - Test_fuzzy_completion_env
-	# Too sensitive to leaked environment variables.
-	# - Test_term_mouse_multiple_clicks_to_select_mode
-	# Hangs.
-	# - Test_spelldump
-	# Hangs.
-	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\)'
-
-	emake -j1 -C src/testdir nongui
-}
-
-# Call eselect vi update with --if-unset
-# to respect user's choice (bug #187449)
-eselect_vi_update() {
-	ebegin "Calling eselect vi update"
-	eselect vi update --if-unset
-	eend $?
-}
-
-src_install() {
-	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
-
-	# Note: Do not install symlinks for 'vi', 'ex', or 'view', as these are
-	#       managed by eselect-vi
-	dobin src/vim
-	if ! use minimal ; then
-		dosym vim /usr/bin/vimdiff
-	fi
-	dosym vim /usr/bin/rvim
-	dosym vim /usr/bin/rview
-	if use vim-pager ; then
-		dosym ${vimfiles}/macros/less.sh /usr/bin/vimpager
-		dosym ${vimfiles}/macros/manpager.sh /usr/bin/vimmanpager
-		insinto ${vimfiles}/macros
-		doins runtime/macros/manpager.sh
-		fperms a+x ${vimfiles}/macros/manpager.sh
-	fi
-
-	domenu runtime/vim.desktop
-
-	newbashcomp "${FILESDIR}"/${PN}-completion ${PN}
-
-	# keep in sync with 'complete ... -F' list
-	bashcomp_alias vim ex vi view rvim rview vimdiff
-}
-
-pkg_postinst() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# Call eselect vi update
-	eselect_vi_update
-
-	# update desktop file mime cache
-	xdg_desktop_database_update
-}
-
-pkg_postrm() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# Call eselect vi update
-	eselect_vi_update
-
-	# update desktop file mime cache
-	xdg_desktop_database_update
-}

sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.0366.ebuild

@@ -1,377 +0,0 @@
-# Copyright 1999-2024 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Please bump with app-editors/vim-core and app-editors/gvim
-
-VIM_VERSION="9.1"
-VIM_PATCHES_VERSION="9.0.2092"
-
-LUA_COMPAT=( lua5-{1..4} luajit )
-PYTHON_COMPAT=( python3_{10..12} )
-PYTHON_REQ_USE="threads(+)"
-USE_RUBY="ruby31 ruby32"
-
-inherit vim-doc flag-o-matic bash-completion-r1 lua-single python-single-r1 ruby-single toolchain-funcs desktop xdg-utils
-
-if [[ ${PV} == 9999* ]] ; then
-	inherit git-r3
-	EGIT_REPO_URI="https://github.com/vim/vim.git"
-else
-	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
-fi
-
-DESCRIPTION="Vim, an improved vi-style text editor"
-HOMEPAGE="https://www.vim.org https://github.com/vim/vim"
-
-LICENSE="vim"
-SLOT="0"
-IUSE="X acl crypt cscope debug gpm lua minimal nls perl python racket ruby selinux sound tcl terminal vim-pager"
-REQUIRED_USE="
-	lua? ( ${LUA_REQUIRED_USE} )
-	python? ( ${PYTHON_REQUIRED_USE} )
-	vim-pager? ( !minimal )
-"
-
-RDEPEND="
-	>=app-eselect/eselect-vi-1.1
-	>=sys-libs/ncurses-5.2-r2:0=
-	nls? ( virtual/libintl )
-	acl? ( kernel_linux? ( sys-apps/acl ) )
-	crypt? ( dev-libs/libsodium:= )
-	cscope? ( dev-util/cscope )
-	gpm? ( >=sys-libs/gpm-1.19.3 )
-	lua? ( ${LUA_DEPS}
-		$(lua_gen_impl_dep 'deprecated' lua5-1)
-	)
-	~app-editors/vim-core-${PV}
-	vim-pager? ( app-editors/vim-core[-minimal] )
-	perl? ( dev-lang/perl:= )
-	python? ( ${PYTHON_DEPS} )
-	racket? ( dev-scheme/racket )
-	ruby? ( ${RUBY_DEPS} )
-	selinux? ( sys-libs/libselinux )
-	sound? ( media-libs/libcanberra )
-	tcl? ( dev-lang/tcl:0= )
-	X? ( x11-libs/libXt )
-"
-DEPEND="${RDEPEND}
-	X? ( x11-base/xorg-proto )
-"
-# configure runs the Lua interpreter
-BDEPEND="
-	dev-build/autoconf
-	lua? ( ${LUA_DEPS} )
-	nls? ( sys-devel/gettext )
-"
-PDEPEND="!minimal? ( app-vim/gentoo-syntax )"
-
-if [[ ${PV} != 9999* ]]; then
-	# Gentoo patches to fix runtime issues, cross-compile errors, etc
-	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
-	)
-fi
-
-# platform-specific checks (bug #898452):
-# - acl()     -- Solaris
-# - statacl() -- AIX
-QA_CONFIG_IMPL_DECL_SKIP=(
-	'acl'
-	'statacl'
-)
-
-pkg_setup() {
-	# people with broken alphabets run into trouble. bug #82186.
-	unset LANG LC_ALL
-	export LC_COLLATE="C"
-
-	use lua && lua-single_pkg_setup
-	use python && python-single-r1_pkg_setup
-}
-
-src_prepare() {
-	default
-
-	# Fixup a script to use awk instead of nawk
-	sed -i -e \
-		'1s|.*|#!'"${EPREFIX}"'/usr/bin/awk -f|' \
-		"${S}"/runtime/tools/mve.awk || die "mve.awk sed failed"
-
-	# Read vimrc and gvimrc from /etc/vim
-	echo '#define SYS_VIMRC_FILE "'${EPREFIX}'/etc/vim/vimrc"' \
-		>> "${S}"/src/feature.h || die "echo failed"
-	echo '#define SYS_GVIMRC_FILE "'${EPREFIX}'/etc/vim/gvimrc"' \
-		>> "${S}"/src/feature.h || die "echo failed"
-
-	# Use exuberant ctags which installs as /usr/bin/exuberant-ctags.
-	# Hopefully this pattern won't break for a while at least.
-	# This fixes bug #29398 (27 Sep 2003 agriffis)
-	sed -i -e \
-		's/\<ctags\("\| [-*.]\)/exuberant-&/g' \
-		"${S}"/runtime/doc/syntax.txt \
-		"${S}"/runtime/doc/tagsrch.txt \
-		"${S}"/runtime/doc/usr_29.txt \
-		"${S}"/runtime/menu.vim \
-		"${S}"/src/configure.ac || die 'sed failed'
-
-	# gcc on sparc32 has this, uhm, interesting problem with detecting EOF
-	# correctly. To avoid some really entertaining error messages about stuff
-	# which isn't even in the source file being invalid, we'll do some trickery
-	# to make the error never occur. bug 66162 (02 October 2004 ciaranm)
-	find "${S}" -name '*.c' | while read c; do
-		echo >> "$c" || die "echo failed"
-	done
-
-	# conditionally make the manpager.sh script
-	if use vim-pager; then
-		cat > "${S}"/runtime/macros/manpager.sh <<-_EOF_ || die "cat EOF failed"
-			#!/bin/sh
-			sed -e 's/\x1B\[[[:digit:]]\+m//g' | col -b | \\
-					vim \\
-						-c 'let no_plugin_maps = 1' \\
-						-c 'set nolist nomod ft=man ts=8' \\
-						-c 'let g:showmarks_enable=0' \\
-						-c 'runtime! macros/less.vim' -
-			_EOF_
-	fi
-
-	# Try to avoid sandbox problems. Bug #114475.
-	if [[ -d "${S}"/src/po ]]; then
-		sed -i -e \
-			'/-S check.vim/s,..VIM.,ln -s $(VIM) testvim \; ./testvim -X,' \
-			"${S}"/src/po/Makefile || die "sed failed"
-	fi
-
-	cp -v "${S}"/src/config.mk.dist "${S}"/src/auto/config.mk || die "cp failed"
-
-	# Fix bug 18245: Prevent "make" from the following chain:
-	# (1) Notice configure.ac is newer than auto/configure
-	# (2) Rebuild auto/configure
-	# (3) Notice auto/configure is newer than auto/config.mk
-	# (4) Run ./configure (with wrong args) to remake auto/config.mk
-	sed -i 's# auto/config\.mk:#:#' src/Makefile || die "Makefile sed failed"
-	rm src/auto/configure || die "rm failed"
-
-	# bug 908961
-	if use elibc_musl ; then
-		sed -i -e '/ja.sjis/d' src/po/Make_all.mak || die
-	fi
-}
-
-src_configure() {
-
-	# Fix bug #37354: Disallow -funroll-all-loops on amd64
-	# Bug #57859 suggests that we want to do this for all archs
-	filter-flags -funroll-all-loops
-
-	# Fix bug 76331: -O3 causes problems, use -O2 instead. We'll do this for
-	# everyone since previous flag filtering bugs have turned out to affect
-	# multiple archs...
-	replace-flags -O3 -O2
-
-	emake -j1 -C src autoconf
-
-	# This should fix a sandbox violation (see bug #24447). The hvc
-	# things are for ppc64, see bug #86433.
-	for file in /dev/pty/s* /dev/console /dev/hvc/* /dev/hvc*; do
-		if [[ -e "${file}" ]]; then
-			addwrite ${file}
-		fi
-	done
-
-	local myconf=()
-	if use minimal; then
-		myconf=(
-			--with-features=tiny
-			--disable-nls
-			--disable-canberra
-			--disable-acl
-			--enable-gui=no
-			--without-x
-			--disable-darwin
-			--disable-luainterp
-			--disable-perlinterp
-			--disable-pythoninterp
-			--disable-mzschemeinterp
-			--disable-rubyinterp
-			--disable-selinux
-			--disable-tclinterp
-			--disable-gpm
-		)
-	else
-		use debug && append-flags "-DDEBUG"
-
-		myconf=(
-			--with-features=huge
-			$(use_enable sound canberra)
-			$(use_enable acl)
-			$(use_enable crypt libsodium)
-			$(use_enable cscope)
-			$(use_enable gpm)
-			$(use_enable nls)
-			$(use_enable perl perlinterp)
-			$(use_enable python python3interp)
-			$(use_with python python3-command "${PYTHON}")
-			$(use_enable racket mzschemeinterp)
-			$(use_enable ruby rubyinterp)
-			$(use_enable selinux)
-			$(use_enable tcl tclinterp)
-			$(use_enable terminal)
-		)
-
-		# --with-features=huge forces on cscope even if we --disable it. We need
-		# to sed this out to avoid screwiness. (1 Sep 2004 ciaranm)
-		if ! use cscope; then
-			sed -i -e \
-				'/# define FEAT_CSCOPE/d' src/feature.h || die "sed failed"
-		fi
-
-		if use lua; then
-			# -DLUA_COMPAT_OPENLIB=1 is required to enable the
-			# deprecated (in 5.1) luaL_openlib API (#874690)
-			use lua_single_target_lua5-1 && append-cppflags -DLUA_COMPAT_OPENLIB=1
-
-			myconf+=(
-				--enable-luainterp
-				$(use_with lua_single_target_luajit luajit)
-				--with-lua-prefix="${EPREFIX}/usr"
-			)
-		fi
-
-		# don't test USE=X here ... see bug #19115
-		# but need to provide a way to link against X ... see bug #20093
-		myconf+=(
-			--enable-gui=no
-			--disable-darwin
-			$(use_with X x)
-		)
-	fi
-
-	# let package manager strip binaries
-	export ac_cv_prog_STRIP="$(type -P true ) faking strip"
-
-	# keep prefix env contained within the EPREFIX
-	use prefix && myconf+=( --without-local-dir )
-
-	if tc-is-cross-compiler ; then
-		export vim_cv_getcwd_broken=no \
-			   vim_cv_memmove_handles_overlap=yes \
-			   vim_cv_stat_ignores_slash=yes \
-			   vim_cv_terminfo=yes \
-			   vim_cv_toupper_broken=no
-	fi
-
-	econf \
-		--with-modified-by="Gentoo-${PVR} (RIP Bram)" \
-		"${myconf[@]}"
-}
-
-src_compile() {
-	# The following allows emake to be used
-	emake -j1 -C src auto/osdef.h objects
-
-	emake
-}
-
-src_test() {
-	einfo
-	einfo "Starting vim tests. Several error messages will be shown"
-	einfo "while the tests run. This is normal behaviour and does not"
-	einfo "indicate a fault."
-	einfo
-	ewarn "If the tests fail, your terminal may be left in a strange"
-	ewarn "state. Usually, running 'reset' will fix this."
-	einfo
-
-	# Don't let vim talk to X
-	unset DISPLAY
-
-	# Arch and opensuse seem to do this and at this point, I'm willing
-	# to try anything to avoid random test hangs!
-	export TERM=xterm
-
-	# See https://github.com/vim/vim/blob/f08b0eb8691ff09f98bc4beef986ece1c521655f/src/testdir/runtest.vim#L5
-	# for more information on test variables we can use.
-	# Note that certain variables need vim-compatible regex (not PCRE), see e.g.
-	# http://www.softpanorama.org/Editors/Vimorama/vim_regular_expressions.shtml.
-	#
-	# Skipped tests:
-	# - Test_expand_star_star
-	# Hangs because of a recursive symlink in /usr/include/nodejs (bug #616680)
-	# - Test_exrc
-	# Looks in wrong location? (bug #742710)
-	# - Test_job_tty_in_out
-	# Fragile and depends on TERM(?)
-	# - Test_spelldump_bang
-	# Hangs.
-	# - Test_fuzzy_completion_env
-	# Too sensitive to leaked environment variables.
-	# - Test_term_mouse_multiple_clicks_to_select_mode
-	# Hangs.
-	# - Test_spelldump
-	# Hangs.
-	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\)'
-
-	emake -j1 -C src/testdir nongui
-}
-
-# Call eselect vi update with --if-unset
-# to respect user's choice (bug #187449)
-eselect_vi_update() {
-	ebegin "Calling eselect vi update"
-	eselect vi update --if-unset
-	eend $?
-}
-
-src_install() {
-	local vimfiles=/usr/share/vim/vim${VIM_VERSION/.}
-
-	# Note: Do not install symlinks for 'vi', 'ex', or 'view', as these are
-	#       managed by eselect-vi
-	dobin src/vim
-	if ! use minimal ; then
-		dosym vim /usr/bin/vimdiff
-	fi
-	dosym vim /usr/bin/rvim
-	dosym vim /usr/bin/rview
-	if use vim-pager ; then
-		dosym ${vimfiles}/macros/less.sh /usr/bin/vimpager
-		dosym ${vimfiles}/macros/manpager.sh /usr/bin/vimmanpager
-		insinto ${vimfiles}/macros
-		doins runtime/macros/manpager.sh
-		fperms a+x ${vimfiles}/macros/manpager.sh
-	fi
-
-	domenu runtime/vim.desktop
-
-	newbashcomp "${FILESDIR}"/${PN}-completion ${PN}
-
-	# keep in sync with 'complete ... -F' list
-	bashcomp_alias vim ex vi view rvim rview vimdiff
-}
-
-pkg_postinst() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# Call eselect vi update
-	eselect_vi_update
-
-	# update desktop file mime cache
-	xdg_desktop_database_update
-}
-
-pkg_postrm() {
-	# Update documentation tags (from vim-doc.eclass)
-	update_vim_helptags
-
-	# Call eselect vi update
-	eselect_vi_update
-
-	# update desktop file mime cache
-	xdg_desktop_database_update
-}

sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.0794.ebuild

@@ -9,7 +9,7 @@ VIM_VERSION="9.1"
 VIM_PATCHES_VERSION="9.0.2092"
 
 LUA_COMPAT=( lua5-{1..4} luajit )
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 PYTHON_REQ_USE="threads(+)"
 USE_RUBY="ruby31 ruby32"
 

sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9.1.1436.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -6,10 +6,10 @@ EAPI=8
 # Please bump with app-editors/vim-core and app-editors/gvim
 
 VIM_VERSION="9.1"
-VIM_PATCHES_VERSION="9.0.2092"
+VIM_PATCHES_VERSION="9.1.1432"
 
 LUA_COMPAT=( lua5-{1..4} luajit )
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{10..14} )
 PYTHON_REQ_USE="threads(+)"
 USE_RUBY="ruby31 ruby32"
 
@@ -20,7 +20,8 @@ if [[ ${PV} == 9999* ]] ; then
 	EGIT_REPO_URI="https://github.com/vim/vim.git"
 else
 	SRC_URI="https://github.com/vim/vim/archive/v${PV}.tar.gz -> ${P}.tar.gz
-		https://git.sr.ht/~xxc3nsoredxx/vim-patches/refs/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.xz"
+		https://gitweb.gentoo.org/proj/vim-patches.git/snapshot/vim-patches-vim-${VIM_PATCHES_VERSION}-patches.tar.bz2"
+		# https://github.com/douglarek/gentoo-vim-patches/releases/download/vim-${VIM_PATCHES_VERSION}-patches/vim-${VIM_PATCHES_VERSION}-patches.tar.gz"
 	KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
@@ -72,7 +73,7 @@ PDEPEND="!minimal? ( app-vim/gentoo-syntax )"
 if [[ ${PV} != 9999* ]]; then
 	# Gentoo patches to fix runtime issues, cross-compile errors, etc
 	PATCHES=(
-		"${WORKDIR}/vim-${VIM_PATCHES_VERSION}-patches"
+		"${WORKDIR}/vim-patches-vim-${VIM_PATCHES_VERSION}-patches"
 	)
 fi
 
@@ -314,7 +315,9 @@ src_test() {
 	# Hangs.
 	# - Test_spelldump
 	# Hangs.
-	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\)'
+	# - Test_glvs_*
+	# Depends on local network.
+	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\|Test_glvs_\)'
 
 	emake -j1 -C src/testdir nongui
 }

sdk_container/src/third_party/portage-stable/app-editors/vim/vim-9999.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2024 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=8
@@ -9,7 +9,7 @@ VIM_VERSION="9.1"
 VIM_PATCHES_VERSION="9.0.2092"
 
 LUA_COMPAT=( lua5-{1..4} luajit )
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..14} )
 PYTHON_REQ_USE="threads(+)"
 USE_RUBY="ruby31 ruby32"
 
@@ -316,7 +316,9 @@ src_test() {
 	# Hangs.
 	# - Test_spelldump
 	# Hangs.
-	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\)'
+	# - Test_glvs_*
+	# Depends on local network.
+	export TEST_SKIP_PAT='\(Test_expand_star_star\|Test_exrc\|Test_job_tty_in_out\|Test_spelldump_bang\|Test_fuzzy_completion_env\|Test_term_mouse_multiple_clicks_to_select_mode\|Test_spelldump\|Test_glvs_\)'
 
 	# Don't do additional GUI tests.
 	emake -j1 -C src/testdir nongui

sdk_container/src/third_party/portage-stable/app-emulation/qemu/Manifest

@@ -1,17 +1,15 @@
 DIST berkeley-softfloat-3-b64af41c3276f97f0e181920400ee056b9c88037.tar.bz2 84094 BLAKE2B 396f9df2e6ad559545054e89916915c3a3c8ff80e5e409498fec497b564d8b3ac9dd3cb966e26dce232ddff82af18a0e84e864ca18a80c2a2f4fe47e320249c2 SHA512 93c20d50a356c90f4293d8c7593611b2e0a9bc7567b6d946319f8ae06962ae1e297c8788f66fd38a1d3a0d44661bff9a07a63eaa84c8bb40ae01a45476be446c
 DIST berkeley-testfloat-3-e7af9751d9f9fd3b47911f51a5cfd08af256a9ab.tar.bz2 90020 BLAKE2B 3dda1ba90c4a5ad5cbce2acf35e93f7adbd387ae0e0f929b2cd4cbdf263f95183103118f32be38e8c80de49d7df44c26319ee2f465061d004ae7e64e43eeeb3e SHA512 65f41f42ea563b2cdceb6c71633f41e6694a79ffd02afed4540353a8e73668ae40118dfc108163aae751acbaa7c49630ed99f423465089503c03aee76b07f221
 DIST keycodemapdb-f5772a62ec52591ff6870b7e8ef32482371f22c6.tar.bz2 27971 BLAKE2B 0ed69ad24c53bd459c8753565814bcc1cd858f20d3a046c38912a35bcb0ba6d388ef5d2b93157cd028959284b330caf5467d82071c3df56a405dd8e08fd177c7 SHA512 8f2cc14e8bd46cb045e3ebfe32e463793ab7472ebda9b57b8ea0b06fa107a1a99c3ebcacb9c4548e30698d8ec154c0e56f789385201182b680819b8068a103f2
+DIST qemu-10.0.0-docs.tar.xz 2651472 BLAKE2B 38be083c0c046e975a829df28089428425904cf66a3ea99cebc99b6f51eebdedf10a60be0c4f6bfb9e6f6cbc5dff1724dcd3b8d0982b5c421158258d869db4f3 SHA512 5f9332340bf68b3c0da4b48174330674f5235b98c3e275792fcbeec4bacca2faa84865c01c0cdd1e95388d9656a5dbf1d6baca2d1c8b2996c42511c966d9edd7
+DIST qemu-10.0.0.tar.xz 135618260 BLAKE2B 3408c7b2a38ace7f0b2e0912411a26cab96cb23bcb03d7095f7b081cb88db55f36b004ff6458281d73190b9cc9006da85dde2a0b4b068c80662a8de205c29fda SHA512 2215458ed8be3ab0b0032fe2a96e79183f5fc2da323d927018412ea3d980b022a07ba87d4f446229eaaa7d1b19a577d438dbcaa3af3bd537c7720b56734a2d8b
+DIST qemu-10.0.2.tar.xz 135678180 BLAKE2B be4ddf050d2102cefded5b4967222df749ee8af92c2427c31a9b29b3800fac8bb328daf2c38d11aa307b51eb7d7243f9b064b3bf24d446a001e5520359ee83c3 SHA512 7fda582c3845ea663aa5eda21bb38ebcfb6c25bccf8944ea6cdf8b5be6946b5a874b36674a7f5db3e325abb9cca0dd9bc0727837fdceb71a8c947d96169a9b20
 DIST qemu-7.2.0-docs.tar.xz 1984184 BLAKE2B 103900fb7903ed8d75f7f012bf61fa2d6fce345b657c851d0437c3384f5735bd1cfd3129320683ea7846ea0b0940e5af5b2663c9320f12fee74b058523a8ea06 SHA512 a7edd448982865e07533c300d3e44a8b50cefbdde1982b73c24d0b2aa74315439252c59b634c75de312860874c7b06c75aa72629da681b5105f28ee936794585
-DIST qemu-7.2.15.tar.xz 124418604 BLAKE2B 629cb5158cdd790947687a06f4c16bf838ae7b0eb5596bc16bb510dfe838bfcc6ed8e7776962bb6d5ab14379cba1a1f6b12683be370eb4e5debce1ecc446b156 SHA512 e8acc9ea6e70bd4dfb0956e01ee212c592c7b99f5dc0676824eb7cba0aeeb863c1d41df9174771fa775f58ca368c745b2fd7356a3c3fa901a11a33dae24d781a
-DIST qemu-7.2.16.tar.xz 124427328 BLAKE2B 25b69d3f47eef164b5bcb990edad7634f4602d08867cf62470b05005c5de496126064ad2eedfdf9b2d78eb724ae7832b93bc4d302140f14e5d77246cd04086eb SHA512 75623733f39396222e549498fd5dbbc1430593033f7480aa3a34c7e1c765eb5f7776d8827ee47b4b9c52cc1061232637742a8e31c5e5a9019945171d0c65ca7e
 DIST qemu-7.2.17.tar.xz 124405828 BLAKE2B 0613eb18a3dfc8af3c907110191eb1e639c8e4ed4ec80842f8a81e373800834ecae6701a8e87f54ea143f1d508b0799d6127ad2174cd5402ec8ad0bdc9e1e21a SHA512 8490fe388db6f72f56cf082eac6aeda6d9eed4749096d2b56dc2f878b058742b586f02fe9a13280eb408b563e8470da53e058505286683cf79a5805aefa2a06e
 DIST qemu-8.2.0-docs.tar.xz 2233352 BLAKE2B 22b9499fdf4ff93e72399dab3803f3171c855859dc7fe111612e2f9146db244ca6d2e0aad16aefdf29b231d2b3a2fbc22171fe6bac13b03445d54555ce798d16 SHA512 f57e78c28277c153fff00b25097d0df5c6ad36cb4e9f3acf30382bfb1c99508503c186c1bbecf266810ef24fd618428fdf3e0eee41c715a552918c9e6ef9e8e5
 DIST qemu-8.2.10.tar.xz 132685948 BLAKE2B a1e9a89ee8bdf36b597c7f59b18d19ea34a83bcbd0c3e6bc18b10b9bb1cfad50561af7814076c07da67b11ac280a1f4b39b55f80bbf715d49f264e6b67c69d2b SHA512 f847f4cf2e17b562fe974cf52ad623c516440344e708141913986130ef0436f6d31653250a458061eff7bbffacd1ec726f69964dddad08c9b907dfb90c3f48b6
-DIST qemu-8.2.7.tar.xz 132676368 BLAKE2B 92235f1a30e1d44cf9f7e40e71e9df0375c5eb2d8b267c35df51e102e560f399e4d3f70c674d7b9e206728d9c4a1bafee5ae8f1a91cda900b422f9a6a48c15a8 SHA512 9806bae62d2bdf0781b6bd1c4d7e88bb97019ca5e85140714d7818912603aed1d522a5d29f3434888974ab73e0cfae8b4136ea018b05dcc2d6f6c8b6252075cd
-DIST qemu-8.2.9.tar.xz 132695608 BLAKE2B 0c10feba46e917cd3110bd5926223068d635be0eea7d3f76ae96d631b7fd4cace9d9023aa589d26a6d4ea27d052f7f0a1c27f47175853cd558e5744d10d20aa6 SHA512 3981ff1f58cb88c9325b0c89d7a5f38e069b2a1d14e2cbd887b39382310a004bcd75c5c601fa0f60eba3e1c020b9f3d56000af0be9fbe99546237c30e3277e54
 DIST qemu-9.1.0-docs.tar.xz 2376072 BLAKE2B 31d13133b3a2e21a7d9b5af028407610ae8f2fa61dd296fc35e57fc12eb66cfd1a39ec5e3b5a3852095d10a388f424f8a38417b3ab58ca30d0817ece779328cf SHA512 5b705b577daad6aa010d5c713db9dc314114334b89901840ebcecc9032595a969f5ad9054e42b36b2be5ef9f5d6dc1159841ff46dbb08314b5c48491aa631040
-DIST qemu-9.1.2.tar.xz 132481332 BLAKE2B 2cbc55e09a8d46fe0c9e3e7e54b6cf4490bef01e8d6fc295158e8f823678cfaedf2f95b8256205cdb14db6e11b932378dee9f653c35c2f1d7e843304336aa2e0 SHA512 ff6ed9bc784f1aa7cf06604d0e38e26ebb2685885893a2cb7d044297f26d7efd0fa6cbb034dc1c422b58504ca1081b46ffe00dd8f9fab928cafa8cfc0d7d1747
 DIST qemu-9.1.3.tar.xz 132492084 BLAKE2B 268c8fb91dd5fc4e393a46a578537338861e5d2a92c381517447c6c2fe67604ed9aacc96371c864dc7f4a800cc9b9f94118d17c5dcc24f3fac5be0a18ca553e5 SHA512 e7b938e72eb4a8a4a6680ce3b282a4e5cbd1ad30003bed959e51ea2621acea7434b4366ef6559e3622fac8865ad212702f393ba7698be38cf2fc8f264b951318
 DIST qemu-9.2.0-docs.tar.xz 2431076 BLAKE2B 420148b9d7cafbdc9aea21b0d0a84a53ca0d17fb99fc34ae4c0786fa7d4ce40838f4b3173508b90742d6dfbfd4b58dda25b2e5cd1394241b0b56a64fe5705d9b SHA512 88816e326e9eac9acf0a1c73e677552845d6885e220b55e795241c40d2c1bd1b1994a22e56f95046e420225e0b7dc839d459f1c1e5318c8c36392727a86b3008
-DIST qemu-9.2.2.tar.xz 134756816 BLAKE2B fe341d25010b02c47c263e6b1bf1a64f72226e188bd79901ec0072005994e305f5c75b8e5b3f36af1e3b3f776a04cd18b4084dc044952f34b131f3b94134f5b8 SHA512 b010876da9f91da01dbb9e06705a1358d5f062d0fdd4ad5c8cd8ce3fd43adcefcf72a61216eb8d415281f6607b945ce1cfb6b5fc5692ada9163e8f05b7fb5533
 DIST qemu-9.2.3.tar.xz 134755248 BLAKE2B cdc7300288d2efc50262c605707caab64638fbf1d7528576a0bce71efc1403ccd6aa647a984c84a5ab8ebca28ea9ee7cd8682b4098ca2e63a2f76d2de577c181 SHA512 941a4337a115c65de2fca042932efb31886114f4300226fcf55f04c2c5471bd2b5ce220c4b17e01c3679bd55ba08a1aa7ce399de15e3e5f28c17da52030b139e
+DIST qemu-9.2.4.tar.xz 134782772 BLAKE2B 40b85e1204da263da16031dd9edd833062d632e437c0699ac582a641e7a7f85525b800649591d57930eafd01b799cde306f62a236e1ff3b54648f3d28f7924b2 SHA512 5aa2ea23d234dd896de73f778defde93f3b490bd22947c396091fdd2231ce5ccd17767c910170a952be88a5593725f1c31b15a6d19b3d30637465d17fb69651c

sdk_container/src/third_party/portage-stable/app-emulation/qemu/files/qemu-9.2.3-virtio-net.patch

@@ -0,0 +1,221 @@
+https://bugs.gentoo.org/955587
+https://gitlab.com/qemu-project/qemu/-/commit/ff765e490eef83480d07673e115060228b01d55e
+https://gitlab.com/qemu-project/qemu/-/commit/af01cf195ba106fe039ab320ce9e8074b4ddd841
+
+From ff765e490eef83480d07673e115060228b01d55e Mon Sep 17 00:00:00 2001
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
+Date: Wed, 8 Jan 2025 21:13:29 +0900
+Subject: [PATCH] virtio-net: Fix num_buffers for version 1
+
+The specification says the device MUST set num_buffers to 1 if
+VIRTIO_NET_F_MRG_RXBUF has not been negotiated.
+
+Fixes: df91055db5c9 ("virtio-net: enable virtio 1.0")
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Message-Id: <20250108-buffers-v1-1-a0c85ff31aeb@daynix.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Tested-by: Lei Yang <leiyang@redhat.com>
+Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+(cherry picked from commit c17ad4b11bd268a35506cd976884562df6ca69d7)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+---
+ hw/net/virtio-net.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index f8c6ccbec45..78b7d88756c 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1999,6 +1999,8 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+                                     offsetof(typeof(hdr),
+                                              virtio_net.hdr.num_buffers),
+                                     sizeof(hdr.virtio_net.hdr.num_buffers));
++            } else {
++                hdr.virtio_net.hdr.num_buffers = cpu_to_le16(1);
+             }
+ 
+             guest_offset = n->has_vnet_hdr ?
+-- 
+GitLab
+
+From af01cf195ba106fe039ab320ce9e8074b4ddd841 Mon Sep 17 00:00:00 2001
+From: Antoine Damhet <adamhet@scaleway.com>
+Date: Tue, 8 Apr 2025 16:53:33 +0200
+Subject: [PATCH] Revert "virtio-net: Copy received header to buffer"
+
+This reverts commit 7987d2be5a8bc3a502f89ba8cf3ac3e09f64d1ce.
+
+The goal was to remove the need to patch the (const) input buffer
+with a recomputed UDP checksum by copying headers to a RW region and
+inject the checksum there. The patch computed the checksum only from the
+header fields (missing the rest of the payload) producing an invalid one
+and making guests fail to acquire a DHCP lease.
+
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2727
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Antoine Damhet <adamhet@scaleway.com>
+Acked-by: Michael S. Tsirkin <mst@redhat.com>
+Message-ID: <20250408145345.142947-1-adamhet@scaleway.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+(cherry picked from commit e28fbd1c525db21f0502b85517f49504c9f9dcd8)
+Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
+---
+ hw/net/virtio-net.c | 87 +++++++++++++++++++++------------------------
+ 1 file changed, 40 insertions(+), 47 deletions(-)
+
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index 78b7d88756c..09ff80c9953 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -1702,44 +1702,41 @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr)
+  * cache.
+  */
+ static void work_around_broken_dhclient(struct virtio_net_hdr *hdr,
+-                                        size_t *hdr_len, const uint8_t *buf,
+-                                        size_t buf_size, size_t *buf_offset)
++                                        uint8_t *buf, size_t size)
+ {
+     size_t csum_size = ETH_HLEN + sizeof(struct ip_header) +
+                        sizeof(struct udp_header);
+ 
+-    buf += *buf_offset;
+-    buf_size -= *buf_offset;
+-
+     if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */
+-        (buf_size >= csum_size && buf_size < 1500) && /* normal sized MTU */
++        (size >= csum_size && size < 1500) && /* normal sized MTU */
+         (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */
+         (buf[23] == 17) && /* ip.protocol == UDP */
+         (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */
+-        memcpy((uint8_t *)hdr + *hdr_len, buf, csum_size);
+-        net_checksum_calculate((uint8_t *)hdr + *hdr_len, csum_size, CSUM_UDP);
++        net_checksum_calculate(buf, size, CSUM_UDP);
+         hdr->flags &= ~VIRTIO_NET_HDR_F_NEEDS_CSUM;
+-        *hdr_len += csum_size;
+-        *buf_offset += csum_size;
+     }
+ }
+ 
+-static size_t receive_header(VirtIONet *n, struct virtio_net_hdr *hdr,
+-                             const void *buf, size_t buf_size,
+-                             size_t *buf_offset)
++static void receive_header(VirtIONet *n, const struct iovec *iov, int iov_cnt,
++                           const void *buf, size_t size)
+ {
+-    size_t hdr_len = n->guest_hdr_len;
+-
+-    memcpy(hdr, buf, sizeof(struct virtio_net_hdr));
+-
+-    *buf_offset = n->host_hdr_len;
+-    work_around_broken_dhclient(hdr, &hdr_len, buf, buf_size, buf_offset);
++    if (n->has_vnet_hdr) {
++        /* FIXME this cast is evil */
++        void *wbuf = (void *)buf;
++        work_around_broken_dhclient(wbuf, wbuf + n->host_hdr_len,
++                                    size - n->host_hdr_len);
+ 
+-    if (n->needs_vnet_hdr_swap) {
+-        virtio_net_hdr_swap(VIRTIO_DEVICE(n), hdr);
++        if (n->needs_vnet_hdr_swap) {
++            virtio_net_hdr_swap(VIRTIO_DEVICE(n), wbuf);
++        }
++        iov_from_buf(iov, iov_cnt, 0, buf, sizeof(struct virtio_net_hdr));
++    } else {
++        struct virtio_net_hdr hdr = {
++            .flags = 0,
++            .gso_type = VIRTIO_NET_HDR_GSO_NONE
++        };
++        iov_from_buf(iov, iov_cnt, 0, &hdr, sizeof hdr);
+     }
+-
+-    return hdr_len;
+ }
+ 
+ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
+@@ -1907,13 +1904,6 @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
+     return (index == new_index) ? -1 : new_index;
+ }
+ 
+-typedef struct Header {
+-    struct virtio_net_hdr_v1_hash virtio_net;
+-    struct eth_header eth;
+-    struct ip_header ip;
+-    struct udp_header udp;
+-} Header;
+-
+ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+                                       size_t size)
+ {
+@@ -1923,15 +1913,15 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
+     size_t lens[VIRTQUEUE_MAX_SIZE];
+     struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
+-    Header hdr;
++    struct virtio_net_hdr_v1_hash extra_hdr;
+     unsigned mhdr_cnt = 0;
+     size_t offset, i, guest_offset, j;
+     ssize_t err;
+ 
+-    memset(&hdr.virtio_net, 0, sizeof(hdr.virtio_net));
++    memset(&extra_hdr, 0, sizeof(extra_hdr));
+ 
+     if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
+-        int index = virtio_net_process_rss(nc, buf, size, &hdr.virtio_net);
++        int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
+         if (index >= 0) {
+             nc = qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
+         }
+@@ -1996,20 +1986,23 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+             if (n->mergeable_rx_bufs) {
+                 mhdr_cnt = iov_copy(mhdr_sg, ARRAY_SIZE(mhdr_sg),
+                                     sg, elem->in_num,
+-                                    offsetof(typeof(hdr),
+-                                             virtio_net.hdr.num_buffers),
+-                                    sizeof(hdr.virtio_net.hdr.num_buffers));
++                                    offsetof(typeof(extra_hdr), hdr.num_buffers),
++                                    sizeof(extra_hdr.hdr.num_buffers));
+             } else {
+-                hdr.virtio_net.hdr.num_buffers = cpu_to_le16(1);
++                extra_hdr.hdr.num_buffers = cpu_to_le16(1);
+             }
+ 
+-            guest_offset = n->has_vnet_hdr ?
+-                           receive_header(n, (struct virtio_net_hdr *)&hdr,
+-                                          buf, size, &offset) :
+-                           n->guest_hdr_len;
+-
+-            iov_from_buf(sg, elem->in_num, 0, &hdr, guest_offset);
+-            total += guest_offset;
++            receive_header(n, sg, elem->in_num, buf, size);
++            if (n->rss_data.populate_hash) {
++                offset = offsetof(typeof(extra_hdr), hash_value);
++                iov_from_buf(sg, elem->in_num, offset,
++                             (char *)&extra_hdr + offset,
++                             sizeof(extra_hdr.hash_value) +
++                             sizeof(extra_hdr.hash_report));
++            }
++            offset = n->host_hdr_len;
++            total += n->guest_hdr_len;
++            guest_offset = n->guest_hdr_len;
+         } else {
+             guest_offset = 0;
+         }
+@@ -2035,11 +2028,11 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     }
+ 
+     if (mhdr_cnt) {
+-        virtio_stw_p(vdev, &hdr.virtio_net.hdr.num_buffers, i);
++        virtio_stw_p(vdev, &extra_hdr.hdr.num_buffers, i);
+         iov_from_buf(mhdr_sg, mhdr_cnt,
+                      0,
+-                     &hdr.virtio_net.hdr.num_buffers,
+-                     sizeof hdr.virtio_net.hdr.num_buffers);
++                     &extra_hdr.hdr.num_buffers,
++                     sizeof extra_hdr.hdr.num_buffers);
+     }
+ 
+     for (j = 0; j < i; j++) {
+-- 
+GitLab

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-10.0.0.ebuild

@@ -18,7 +18,7 @@ PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
 
 FIRMWARE_ABI_VERSION="7.2.0"
 
-inherit eapi9-ver linux-info toolchain-funcs python-r1 udev fcaps \
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
 		readme.gentoo-r1 pax-utils xdg-utils
 
 if [[ ${PV} == *9999* ]]; then
@@ -66,7 +66,7 @@ IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
 	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
 	+slirp
 	smartcard snappy spice ssh static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xdp xen
+	usbredir vde +vhost-net virgl virtfs +vnc vte wayland X xattr xdp xen
 	zstd"
 
 COMMON_TARGETS="
@@ -177,14 +177,14 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
 		dev-libs/nettle:=[static-libs(+)]
 	)
 	gtk? (
-		x11-libs/gtk+:3
+		x11-libs/gtk+:3[wayland?,X?]
 		vte? ( x11-libs/vte:2.91 )
 	)
 	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
@@ -246,7 +246,7 @@ SEABIOS_VERSION="1.16.3"
 X86_FIRMWARE_DEPEND="
 	pin-upstream-blobs? (
 		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
+		~sys-firmware/ipxe-1.21.1_p20230601[binary,qemu]
 		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
 		~sys-firmware/sgabios-0.1_pre10[binary]
 	)
@@ -478,6 +478,10 @@ src_prepare() {
 	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
 	export WINDRES=${CHOST}-windres
 
+	# defang automagic dependencies
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
+
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
 		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.16.ebuild

@@ -1,981 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
-QEMU_DOCS_PREBUILT_DEV=ajak
-QEMU_DOCS_VERSION="7.2.0"
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# bug #830088
-QEMU_DOC_USEFLAG="+doc"
-
-PYTHON_COMPAT=( python3_{11..12} )
-PYTHON_REQ_USE="ncurses,readline"
-
-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
-
-if [[ ${PV} == *9999* ]]; then
-	QEMU_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
-	EGIT_SUBMODULES=(
-		tests/fp/berkeley-softfloat-3
-		tests/fp/berkeley-testfloat-3
-		ui/keycodemapdb
-	)
-	inherit git-r3
-	SRC_URI=""
-else
-	MY_P="${PN}-${PV/_rc/-rc}"
-	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
-
-	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
-fi
-
-DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
-HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
-
-LICENSE="GPL-2 LGPL-2 BSD-2"
-SLOT="0"
-
-[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
-
-IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
-	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg
-	lzo multipath
-	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
-	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
-	+slirp
-	smartcard snappy spice ssh static static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
-	zstd"
-
-COMMON_TARGETS="
-	aarch64
-	alpha
-	arm
-	cris
-	hppa
-	i386
-	loongarch64
-	m68k
-	microblaze
-	microblazeel
-	mips
-	mips64
-	mips64el
-	mipsel
-	nios2
-	or1k
-	ppc
-	ppc64
-	riscv32
-	riscv64
-	s390x
-	sh4
-	sh4eb
-	sparc
-	sparc64
-	x86_64
-	xtensa
-	xtensaeb
-"
-IUSE_SOFTMMU_TARGETS="
-	${COMMON_TARGETS}
-	avr
-	rx
-	tricore
-"
-IUSE_USER_TARGETS="
-	${COMMON_TARGETS}
-	aarch64_be
-	armeb
-	hexagon
-	mipsn32
-	mipsn32el
-	ppc64le
-	sparc32plus
-"
-
-use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
-use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
-IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
-
-RESTRICT="!test? ( test )"
-
-# Allow no targets to be built so that people can get a tools-only build.
-# Block USE flag configurations known to not work.
-REQUIRED_USE="
-	${PYTHON_REQUIRED_USE}
-	qemu_softmmu_targets_arm? ( fdt )
-	qemu_softmmu_targets_microblaze? ( fdt )
-	qemu_softmmu_targets_mips64el? ( fdt )
-	qemu_softmmu_targets_ppc64? ( fdt )
-	qemu_softmmu_targets_ppc? ( fdt )
-	qemu_softmmu_targets_riscv32? ( fdt )
-	qemu_softmmu_targets_riscv64? ( fdt )
-	qemu_softmmu_targets_x86_64? ( fdt )
-	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
-	static-user? ( !plugins )
-	virgl? ( opengl )
-	virtfs? ( xattr )
-	vnc? ( gnutls )
-	vte? ( gtk )
-	multipath? ( udev )
-	plugins? ( !static !static-user )
-"
-for smname in ${IUSE_SOFTMMU_TARGETS} ; do
-	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
-done
-
-# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
-# and user/softmmu targets (qemu-*, qemu-system-*).
-#
-# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
-#
-# The attr lib isn't always linked in (although the USE flag is always
-# respected).  This is because qemu supports using the C library's API
-# when available rather than always using the external library.
-ALL_DEPEND="
-	dev-libs/glib:2[static-libs(+)]
-	sys-libs/zlib[static-libs(+)]
-	python? ( ${PYTHON_DEPS} )
-	systemtap? ( dev-debug/systemtap )
-	xattr? ( sys-apps/attr[static-libs(+)] )"
-
-# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
-# softmmu targets (qemu-system-*).
-SOFTMMU_TOOLS_DEPEND="
-	sys-libs/libcap-ng[static-libs(+)]
-	>=x11-libs/pixman-0.28.0[static-libs(+)]
-	accessibility? (
-		app-accessibility/brltty[api]
-		app-accessibility/brltty[static-libs(+)]
-	)
-	aio? ( dev-libs/libaio[static-libs(+)] )
-	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
-	bzip2? ( app-arch/bzip2[static-libs(+)] )
-	capstone? ( dev-libs/capstone:=[static-libs(+)] )
-	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
-	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
-	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
-	gnutls? (
-		>=net-libs/gnutls-3.0:=[static-libs(+)]
-		dev-libs/nettle:=[static-libs(+)]
-	)
-	gtk? (
-		x11-libs/cairo
-		x11-libs/gdk-pixbuf:2
-		x11-libs/gtk+:3
-		x11-libs/libX11
-		vte? ( x11-libs/vte:2.91 )
-	)
-	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
-	iscsi? ( net-libs/libiscsi )
-	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
-	jack? ( virtual/jack )
-	jemalloc? ( dev-libs/jemalloc )
-	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
-	lzo? ( dev-libs/lzo:2[static-libs(+)] )
-	multipath? ( sys-fs/multipath-tools )
-	ncurses? (
-		sys-libs/ncurses:=[unicode(+)]
-		sys-libs/ncurses:=[static-libs(+)]
-	)
-	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
-	numa? ( sys-process/numactl[static-libs(+)] )
-	opengl? (
-		virtual/opengl
-		media-libs/libepoxy[static-libs(+)]
-		media-libs/mesa[static-libs(+)]
-		media-libs/mesa[egl(+),gbm(+)]
-	)
-	pam? ( sys-libs/pam )
-	png? ( media-libs/libpng:0=[static-libs(+)] )
-	pulseaudio? ( media-libs/libpulse )
-	rbd? ( sys-cluster/ceph )
-	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
-	sdl? (
-		media-libs/libsdl2[video]
-		media-libs/libsdl2[static-libs(+)]
-	)
-	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
-	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
-	slirp? ( net-libs/libslirp[static-libs(+)] )
-	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
-	snappy? ( app-arch/snappy:= )
-	spice? (
-		>=app-emulation/spice-protocol-0.12.3
-		>=app-emulation/spice-0.12.0[static-libs(+)]
-	)
-	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
-	udev? ( virtual/libudev:= )
-	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
-	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
-	vde? ( net-misc/vde[static-libs(+)] )
-	virgl? ( media-libs/virglrenderer[static-libs(+)] )
-	virtfs? ( sys-libs/libcap )
-	xen? ( app-emulation/xen-tools:= )
-	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
-"
-
-EDK2_OVMF_VERSION="202202"
-SEABIOS_VERSION="1.16.0"
-
-X86_FIRMWARE_DEPEND="
-	pin-upstream-blobs? (
-		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
-		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
-		~sys-firmware/sgabios-0.1_pre10[binary]
-	)
-	!pin-upstream-blobs? (
-		|| (
-			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
-			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		)
-		sys-firmware/ipxe[qemu]
-		|| (
-			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
-			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
-		)
-		sys-firmware/sgabios
-	)"
-PPC_FIRMWARE_DEPEND="
-	pin-upstream-blobs? (
-		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
-	)
-	!pin-upstream-blobs? (
-		|| (
-			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
-			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
-		)
-	)
-"
-
-BDEPEND="
-	$(python_gen_impl_dep)
-	dev-lang/perl
-	dev-build/meson
-	sys-apps/texinfo
-	virtual/pkgconfig
-	doc? (
-		dev-python/sphinx[${PYTHON_USEDEP}]
-		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
-	)
-	gtk? ( nls? ( sys-devel/gettext ) )
-	test? (
-		dev-libs/glib[utils]
-		app-alternatives/bc
-	)
-"
-CDEPEND="
-	!static? (
-		${ALL_DEPEND//\[static-libs(+)]}
-		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
-	)
-	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
-	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
-	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
-	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
-"
-DEPEND="${CDEPEND}
-	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
-	static? (
-		${ALL_DEPEND}
-		${SOFTMMU_TOOLS_DEPEND}
-	)
-	static-user? ( ${ALL_DEPEND} )"
-RDEPEND="${CDEPEND}
-	acct-group/kvm
-	selinux? (
-		sec-policy/selinux-qemu
-		sys-libs/libselinux
-	)"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-6.0.0-make.patch
-	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
-	"${FILESDIR}"/${PN}-9.0.0-glibc-2.41.patch
-	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
-)
-
-QA_PREBUILT="
-	usr/share/qemu/hppa-firmware.img
-	usr/share/qemu/openbios-ppc
-	usr/share/qemu/openbios-sparc64
-	usr/share/qemu/openbios-sparc32
-	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
-	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
-	usr/share/qemu/palcode-clipper
-	usr/share/qemu/s390-ccw.img
-	usr/share/qemu/s390-netboot.img
-	usr/share/qemu/u-boot.e500
-"
-
-QA_WX_LOAD="usr/bin/qemu-i386
-	usr/bin/qemu-x86_64
-	usr/bin/qemu-alpha
-	usr/bin/qemu-arm
-	usr/bin/qemu-cris
-	usr/bin/qemu-m68k
-	usr/bin/qemu-microblaze
-	usr/bin/qemu-microblazeel
-	usr/bin/qemu-mips
-	usr/bin/qemu-mipsel
-	usr/bin/qemu-or1k
-	usr/bin/qemu-ppc
-	usr/bin/qemu-ppc64
-	usr/bin/qemu-sh4
-	usr/bin/qemu-sh4eb
-	usr/bin/qemu-sparc
-	usr/bin/qemu-sparc64
-	usr/bin/qemu-armeb
-	usr/bin/qemu-sparc32plus
-	usr/bin/qemu-s390x
-	usr/bin/qemu-unicore32
-"
-
-DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
-kernel module loaded before running kvm. The easiest way to ensure that the
-kernel module is loaded is to load it on boot.
-	For AMD CPUs the module is called 'kvm-amd'.
-	For Intel CPUs the module is called 'kvm-intel'.
-Please review /etc/conf.d/modules for how to load these.
-
-Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
-then have <USER> re-login.
-
-For brand new installs, the default permissions on /dev/kvm might not let
-you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
-
-If you want to register binfmt handlers for qemu user targets:
-For openrc:
-	# rc-update add qemu-binfmt
-For systemd:
-	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
-
-pkg_pretend() {
-	if use kernel_linux && kernel_is lt 2 6 25; then
-		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
-	elif use kernel_linux; then
-		if ! linux_config_exists; then
-			eerror "Unable to check your kernel for KVM support"
-		else
-			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
-			ERROR_KVM="You must enable KVM in your kernel to continue"
-			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
-			ERROR_KVM_AMD+=" your kernel configuration."
-			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
-			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
-			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
-			ERROR_TUN+=" into your kernel or loaded as a module to use the"
-			ERROR_TUN+=" virtual network device if using -net tap."
-			ERROR_BRIDGE="You will also need support for 802.1d"
-			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
-			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
-			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
-			ERROR_VHOST_NET+=" support"
-
-			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
-				if grep -q AuthenticAMD /proc/cpuinfo; then
-					CONFIG_CHECK+=" ~KVM_AMD"
-				elif grep -q GenuineIntel /proc/cpuinfo; then
-					CONFIG_CHECK+=" ~KVM_INTEL"
-				fi
-			fi
-
-			use python && CONFIG_CHECK+=" ~DEBUG_FS"
-			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
-
-			# Now do the actual checks setup above
-			check_extra_config
-		fi
-	fi
-
-	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
-		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
-		eerror "instances are still pointing to it.  Please update your"
-		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
-		eerror "and the right system binary (e.g. qemu-system-x86_64)."
-		die "update your virt configs to not use qemu-kvm"
-	fi
-}
-
-# Sanity check to make sure target lists are kept up-to-date.
-check_targets() {
-	local var=$1 mak=$2
-	local detected sorted
-
-	pushd "${S}"/configs/targets/ >/dev/null || die
-
-	# Force C locale until glibc is updated. #564936
-	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
-	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
-	if [[ ${sorted} != "${detected}" ]] ; then
-		eerror "The ebuild needs to be kept in sync."
-		eerror "${var}: ${sorted}"
-		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
-		die "sync ${var} to the list of targets"
-	fi
-
-	popd >/dev/null
-}
-
-src_prepare() {
-	check_targets IUSE_SOFTMMU_TARGETS softmmu
-	check_targets IUSE_USER_TARGETS linux-user
-
-	default
-
-	# Use correct toolchain to fix cross-compiling
-	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
-	export WINDRES=${CHOST}-windres
-
-	# Workaround for bug #938302
-	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
-		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
-		[binaries]
-		dtrace='stap-dtrace'
-		EOF
-	fi
-
-	# Verbose builds
-	MAKEOPTS+=" V=1"
-
-	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
-	# this setting (-U then -D..=2) will prevent us from trying out 3, so
-	# drop it. No change to level of protection b/c we patch our toolchain.
-	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
-
-	# Remove bundled modules
-	rm -r dtc meson roms/*/ || die
-}
-
-##
-# configures qemu based on the build directory and the build type
-# we are using.
-#
-qemu_src_configure() {
-	debug-print-function ${FUNCNAME} "$@"
-
-	local buildtype=$1
-	local builddir="${S}/${buildtype}-build"
-
-	mkdir "${builddir}" || die
-
-	local conf_opts=(
-		--prefix=/usr
-		--sysconfdir=/etc
-		--bindir=/usr/bin
-		--libdir=/usr/$(get_libdir)
-		--datadir=/usr/share
-		--docdir=/usr/share/doc/${PF}/html
-		--mandir=/usr/share/man
-		--localstatedir=/var
-		--disable-bsd-user
-		--disable-containers # bug #732972
-		--disable-guest-agent
-		--disable-strip
-		--with-git-submodules=ignore
-
-		# bug #746752: TCG interpreter has a few limitations:
-		# - it does not support FPU
-		# - it's generally slower on non-self-modifying code
-		# It's advantage is support for host architectures
-		# where native codegeneration is not implemented.
-		# Gentoo has qemu keyworded only on targets with
-		# native code generation available. Avoid the interpreter.
-		--disable-tcg-interpreter
-
-		--disable-werror
-		# We support gnutls/nettle for crypto operations.  It is possible
-		# to use gcrypt when gnutls/nettle are disabled (but not when they
-		# are enabled), but it's not really worth the hassle.  Disable it
-		# all the time to avoid automatically detecting it. #568856
-		--disable-gcrypt
-		--cc="$(tc-getCC)"
-		--cxx="$(tc-getCXX)"
-		--host-cc="$(tc-getBUILD_CC)"
-
-		$(use_enable alsa)
-		$(use_enable debug debug-info)
-		$(use_enable debug debug-tcg)
-		$(use_enable jack)
-		$(use_enable nls gettext)
-		$(use_enable oss)
-		$(use_enable plugins)
-		$(use_enable pulseaudio pa)
-		$(use_enable selinux)
-		$(use_enable xattr attr)
-	)
-
-	# Disable options not used by user targets. This simplifies building
-	# static user targets (USE=static-user) considerably.
-	conf_notuser() {
-		if [[ ${buildtype} == "user" ]] ; then
-			echo "--disable-${2:-$1}"
-		else
-			use_enable "$@"
-		fi
-	}
-	# Enable option only for softmmu build, but not 'user' or 'tools'
-	conf_softmmu() {
-		if [[ ${buildtype} == "softmmu" ]] ; then
-			use_enable "$@"
-		else
-			echo "--disable-${2:-$1}"
-		fi
-	}
-	# Enable option only for tools build, but not 'user' or 'softmmu'
-	conf_tools() {
-		if [[ ${buildtype} == "tools" ]] ; then
-			use_enable "$@"
-		else
-			echo "--disable-${2:-$1}"
-		fi
-	}
-	# Special case for the malloc flag, because the --disable flag does
-	# not exist and trying like above will break configuring.
-	conf_malloc() {
-		if [[ ! ${buildtype} == "user" ]] ; then
-			usex "${1}" "--enable-malloc=${1}" ""
-		fi
-	}
-	conf_opts+=(
-		$(conf_notuser accessibility brlapi)
-		$(conf_notuser aio linux-aio)
-		$(conf_softmmu bpf)
-		$(conf_notuser bzip2)
-		$(conf_notuser capstone)
-		$(conf_notuser curl)
-		$(conf_tools doc docs)
-		$(conf_notuser fdt)
-		$(conf_notuser fuse)
-		$(conf_notuser glusterfs)
-		$(conf_notuser gnutls)
-		$(conf_notuser gnutls nettle)
-		$(conf_notuser gtk)
-		$(conf_notuser infiniband rdma)
-		$(conf_notuser iscsi libiscsi)
-		$(conf_notuser io-uring linux-io-uring)
-		$(conf_malloc jemalloc)
-		$(conf_notuser jpeg vnc-jpeg)
-		$(conf_notuser kernel_linux kvm)
-		$(conf_notuser lzo)
-		$(conf_notuser multipath mpath)
-		$(conf_notuser ncurses curses)
-		$(conf_notuser nfs libnfs)
-		$(conf_notuser numa)
-		$(conf_notuser opengl)
-		$(conf_notuser pam auth-pam)
-		$(conf_notuser png)
-		$(conf_notuser rbd)
-		$(conf_notuser sasl vnc-sasl)
-		$(conf_notuser sdl)
-		$(conf_softmmu sdl-image)
-		$(conf_notuser seccomp)
-		$(conf_notuser slirp)
-		$(conf_notuser smartcard)
-		$(conf_notuser snappy)
-		$(conf_notuser spice)
-		$(conf_notuser ssh libssh)
-		$(conf_notuser udev libudev)
-		$(conf_notuser usb libusb)
-		$(conf_notuser usbredir usb-redir)
-		$(conf_notuser vde)
-		$(conf_notuser vhost-net)
-		$(conf_notuser virgl virglrenderer)
-		$(conf_softmmu virtfs)
-		$(conf_notuser vnc)
-		$(conf_notuser vte)
-		$(conf_notuser xen)
-		$(conf_notuser xen xen-pci-passthrough)
-		# use prebuilt keymaps, bug #759604
-		--disable-xkbcommon
-		$(conf_notuser zstd)
-	)
-
-	if [[ ! ${buildtype} == "user" ]] ; then
-		# audio options
-		local audio_opts=(
-			# Note: backend order matters here: #716202
-			# We iterate from higher-level to lower level.
-			$(usex pulseaudio pa "")
-			$(usev jack)
-			$(usev sdl)
-			$(usev alsa)
-			$(usev oss)
-		)
-		conf_opts+=(
-			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
-		)
-	fi
-
-	case ${buildtype} in
-	user)
-		conf_opts+=(
-			--enable-linux-user
-			--disable-system
-			--disable-blobs
-			--disable-tools
-			--disable-cap-ng
-			--disable-seccomp
-		)
-		local static_flag="static-user"
-		;;
-	softmmu)
-		conf_opts+=(
-			--disable-linux-user
-			--enable-system
-			--disable-tools
-			--enable-cap-ng
-			--enable-seccomp
-		)
-		local static_flag="static"
-		;;
-	tools)
-		conf_opts+=(
-			--disable-linux-user
-			--disable-system
-			--disable-blobs
-			--enable-tools
-			--enable-cap-ng
-		)
-		local static_flag="static"
-		;;
-	esac
-
-	local targets="${buildtype}_targets"
-	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
-
-	# Add support for SystemTap
-	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
-
-	# We always want to attempt to build with PIE support as it results
-	# in a more secure binary. But it doesn't work with static or if
-	# the current GCC doesn't have PIE support.
-	if use ${static_flag}; then
-		conf_opts+=( --static --disable-pie )
-	else
-		tc-enables-pie && conf_opts+=( --enable-pie )
-	fi
-
-	# Meson will not use a cross-file unless cross_prefix is set.
-	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
-
-	# Plumb through equivalent of EXTRA_ECONF to allow experiments
-	# like bug #747928.
-	conf_opts+=( ${EXTRA_CONF_QEMU} )
-
-	echo "../configure ${conf_opts[*]}"
-	cd "${builddir}"
-	../configure "${conf_opts[@]}" || die "configure failed"
-}
-
-src_configure() {
-	local target
-
-	python_setup
-
-	softmmu_targets= softmmu_bins=()
-	user_targets= user_bins=()
-
-	for target in ${IUSE_SOFTMMU_TARGETS} ; do
-		if use "qemu_softmmu_targets_${target}"; then
-			softmmu_targets+=",${target}-softmmu"
-			softmmu_bins+=( "qemu-system-${target}" )
-		fi
-	done
-
-	for target in ${IUSE_USER_TARGETS} ; do
-		if use "qemu_user_targets_${target}"; then
-			user_targets+=",${target}-linux-user"
-			user_bins+=( "qemu-${target}" )
-		fi
-	done
-
-	softmmu_targets=${softmmu_targets#,}
-	user_targets=${user_targets#,}
-
-	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
-	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
-	qemu_src_configure "tools"
-}
-
-src_compile() {
-	if [[ -n ${user_targets} ]]; then
-		cd "${S}/user-build" || die
-		default
-	fi
-
-	if [[ -n ${softmmu_targets} ]]; then
-		cd "${S}/softmmu-build" || die
-		default
-	fi
-
-	cd "${S}/tools-build" || die
-	default
-}
-
-src_test() {
-	if [[ -n ${softmmu_targets} ]]; then
-		cd "${S}/softmmu-build" || die
-		pax-mark m */qemu-system-* #515550
-		emake check
-	fi
-}
-
-qemu_python_install() {
-	python_domodule "${S}/python/qemu"
-
-	python_doscript "${S}/scripts/kvm/vmxcap"
-	python_doscript "${S}/scripts/qmp/qmp-shell"
-	python_doscript "${S}/scripts/qmp/qemu-ga-client"
-}
-
-# Generate binfmt support files.
-#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
-#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
-generate_initd() {
-	local out="${T}/qemu-binfmt"
-	local out_systemd="${T}/qemu.conf"
-	local d="${T}/binfmt.d"
-
-	einfo "Generating qemu binfmt scripts and configuration files"
-
-	# Generate the debian fragments first.
-	mkdir -p "${d}"
-	"${S}"/scripts/qemu-binfmt-conf.sh \
-		--debian \
-		--exportdir "${d}" \
-		--qemu-path "${EPREFIX}/usr/bin" \
-		|| die
-	# Then turn the fragments into a shell script we can source.
-	sed -E -i \
-		-e 's:^([^ ]+) (.*)$:\1="\2":' \
-		"${d}"/* || die
-
-	# Generate the init.d script by assembling the fragments from above.
-	local f qcpu package interpreter magic mask
-	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
-	for f in "${d}"/qemu-* ; do
-		source "${f}"
-
-		# Normalize the cpu logic like we do in the init.d for the native cpu.
-		qcpu=${package#qemu-}
-		case ${qcpu} in
-		arm*)   qcpu="arm";;
-		mips*)  qcpu="mips";;
-		ppc*)   qcpu="ppc";;
-		s390*)  qcpu="s390";;
-		sh*)    qcpu="sh";;
-		sparc*) qcpu="sparc";;
-		esac
-
-		# we use 'printf' here to be portable across 'sh'
-		# implementations: #679168
-		cat <<EOF >>"${out}"
-	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
-		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
-	fi
-EOF
-
-		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
-
-	done
-	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
-}
-
-src_install() {
-	if [[ -n ${user_targets} ]]; then
-		cd "${S}/user-build"
-		emake DESTDIR="${ED}" install
-
-		# Install binfmt handler init script for user targets.
-		generate_initd
-		doinitd "${T}/qemu-binfmt"
-
-		# Install binfmt/qemu.conf.
-		insinto "/usr/share/qemu/binfmt.d"
-		doins "${T}/qemu.conf"
-	fi
-
-	if [[ -n ${softmmu_targets} ]]; then
-		cd "${S}/softmmu-build"
-		emake DESTDIR="${ED}" install
-
-		# This might not exist if the test failed. #512010
-		[[ -e check-report.html ]] && dodoc check-report.html
-
-		if use kernel_linux; then
-			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
-		fi
-
-		if use python; then
-			python_foreach_impl qemu_python_install
-		fi
-	fi
-
-	cd "${S}/tools-build" || die
-	emake DESTDIR="${ED}" install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
-	fi
-
-	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
-	pushd "${ED}"/usr/bin >/dev/null || die
-	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
-	popd >/dev/null || die
-
-	# Install config file example for qemu-bridge-helper
-	insinto "/etc/qemu"
-	doins "${FILESDIR}/bridge.conf"
-
-	cd "${S}" || die
-	dodoc MAINTAINERS docs/specs/pci-ids.txt
-	newdoc pc-bios/README README.pc-bios
-
-	# Disallow stripping of prebuilt firmware files.
-	dostrip -x ${QA_PREBUILT}
-
-	if [[ -n ${softmmu_targets} ]]; then
-		# Remove SeaBIOS since we're using the SeaBIOS packaged one
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
-			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
-		fi
-
-		# Remove vgabios since we're using the seavgabios packaged one
-		rm "${ED}/usr/share/qemu/vgabios.bin"
-		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
-		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
-		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
-		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
-		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
-
-		# PPC/PPC64 loads vgabios-stdvga
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
-			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
-			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
-			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
-			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
-			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
-			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
-		fi
-
-		# Remove sgabios since we're using the sgabios packaged one
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
-			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
-		fi
-
-		# Remove iPXE since we're using the iPXE packaged one
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
-			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
-			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
-			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
-			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
-			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
-			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
-		fi
-	fi
-
-	DISABLE_AUTOFORMATTING=true
-	readme.gentoo_create_doc
-}
-
-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
-pkg_postinst() {
-	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
-		udev_reload
-	fi
-
-	xdg_icon_cache_update
-
-	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
-
-	DISABLE_AUTOFORMATTING=true
-	readme.gentoo_print_elog
-
-	if use pin-upstream-blobs && firmware_abi_change; then
-		ewarn "This version of qemu pins new versions of firmware blobs:"
-
-		if has_version 'sys-firmware/edk2-bin'; then
-			ewarn "	$(best_version sys-firmware/edk2-bin)"
-		else
-			ewarn " $(best_version sys-firmware/edk2)"
-		fi
-
-		if has_version 'sys-firmware/seabios-bin'; then
-			ewarn "	$(best_version sys-firmware/seabios-bin)"
-		else
-			ewarn " $(best_version sys-firmware/seabios)"
-		fi
-
-		ewarn "	$(best_version sys-firmware/ipxe)"
-		ewarn "	$(best_version sys-firmware/sgabios)"
-		ewarn "This might break resume of hibernated guests (started with a different"
-		ewarn "firmware version) and live migration to/from qemu versions with different"
-		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
-		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
-	fi
-}
-
-pkg_info() {
-	echo "Using:"
-	echo "  $(best_version app-emulation/spice-protocol)"
-
-	if has_version 'sys-firmware/edk2-bin'; then
-		echo "  $(best_version sys-firmware/edk2-bin)"
-	else
-		echo "  $(best_version sys-firmware/edk2)"
-	fi
-
-	if has_version 'sys-firmware/seabios-bin'; then
-		echo "  $(best_version sys-firmware/seabios-bin)"
-	else
-		echo "  $(best_version sys-firmware/seabios)"
-	fi
-
-	echo "  $(best_version sys-firmware/ipxe)"
-	echo "  $(best_version sys-firmware/sgabios)"
-}
-
-pkg_postrm() {
-	xdg_icon_cache_update
-	udev_reload
-}

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17-r1.ebuild

@@ -173,7 +173,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
@@ -315,6 +315,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-7.2.17.ebuild

@@ -1,980 +0,0 @@
-# Copyright 1999-2025 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=8
-
-# Generate using https://github.com/thesamesam/sam-gentoo-scripts/blob/main/niche/generate-qemu-docs
-# Set to 1 if prebuilt, 0 if not
-# (the construct below is to allow overriding from env for script)
-QEMU_DOCS_PREBUILT=${QEMU_DOCS_PREBUILT:-1}
-QEMU_DOCS_PREBUILT_DEV=ajak
-QEMU_DOCS_VERSION="7.2.0"
-# Default to generating docs (inc. man pages) if no prebuilt; overridden later
-# bug #830088
-QEMU_DOC_USEFLAG="+doc"
-
-PYTHON_COMPAT=( python3_{11..12} )
-PYTHON_REQ_USE="ncurses,readline"
-
-FIRMWARE_ABI_VERSION="7.2.0"
-
-inherit linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
-
-if [[ ${PV} == *9999* ]]; then
-	QEMU_DOCS_PREBUILT=0
-
-	EGIT_REPO_URI="https://gitlab.com/qemu-project/qemu.git/"
-	EGIT_SUBMODULES=(
-		tests/fp/berkeley-softfloat-3
-		tests/fp/berkeley-testfloat-3
-		ui/keycodemapdb
-	)
-	inherit git-r3
-	SRC_URI=""
-else
-	MY_P="${PN}-${PV/_rc/-rc}"
-	SRC_URI="https://download.qemu.org/${MY_P}.tar.xz"
-
-	if [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
-		SRC_URI+=" !doc? ( https://dev.gentoo.org/~${QEMU_DOCS_PREBUILT_DEV}/distfiles/${CATEGORY}/${PN}/${PN}-${QEMU_DOCS_VERSION}-docs.tar.xz )"
-	fi
-
-	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
-fi
-
-DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
-HOMEPAGE="https://www.qemu.org https://www.linux-kvm.org"
-
-LICENSE="GPL-2 LGPL-2 BSD-2"
-SLOT="0"
-
-[[ ${QEMU_DOCS_PREBUILT} == 1 ]] && QEMU_DOC_USEFLAG="doc"
-
-IUSE="accessibility +aio alsa bpf bzip2 capstone +curl debug ${QEMU_DOC_USEFLAG}
-	+fdt fuse glusterfs +gnutls gtk infiniband iscsi io-uring
-	jack jemalloc +jpeg
-	lzo multipath
-	ncurses nfs nls numa opengl +oss pam +pin-upstream-blobs
-	plugins +png pulseaudio python rbd sasl +seccomp sdl sdl-image selinux
-	+slirp
-	smartcard snappy spice ssh static static-user systemtap test udev usb
-	usbredir vde +vhost-net virgl virtfs +vnc vte xattr xen
-	zstd"
-
-COMMON_TARGETS="
-	aarch64
-	alpha
-	arm
-	cris
-	hppa
-	i386
-	loongarch64
-	m68k
-	microblaze
-	microblazeel
-	mips
-	mips64
-	mips64el
-	mipsel
-	nios2
-	or1k
-	ppc
-	ppc64
-	riscv32
-	riscv64
-	s390x
-	sh4
-	sh4eb
-	sparc
-	sparc64
-	x86_64
-	xtensa
-	xtensaeb
-"
-IUSE_SOFTMMU_TARGETS="
-	${COMMON_TARGETS}
-	avr
-	rx
-	tricore
-"
-IUSE_USER_TARGETS="
-	${COMMON_TARGETS}
-	aarch64_be
-	armeb
-	hexagon
-	mipsn32
-	mipsn32el
-	ppc64le
-	sparc32plus
-"
-
-use_softmmu_targets=$(printf ' qemu_softmmu_targets_%s' ${IUSE_SOFTMMU_TARGETS})
-use_user_targets=$(printf ' qemu_user_targets_%s' ${IUSE_USER_TARGETS})
-IUSE+=" ${use_softmmu_targets} ${use_user_targets}"
-
-RESTRICT="!test? ( test )"
-
-# Allow no targets to be built so that people can get a tools-only build.
-# Block USE flag configurations known to not work.
-REQUIRED_USE="
-	${PYTHON_REQUIRED_USE}
-	qemu_softmmu_targets_arm? ( fdt )
-	qemu_softmmu_targets_microblaze? ( fdt )
-	qemu_softmmu_targets_mips64el? ( fdt )
-	qemu_softmmu_targets_ppc64? ( fdt )
-	qemu_softmmu_targets_ppc? ( fdt )
-	qemu_softmmu_targets_riscv32? ( fdt )
-	qemu_softmmu_targets_riscv64? ( fdt )
-	qemu_softmmu_targets_x86_64? ( fdt )
-	sdl-image? ( sdl )
-	static? ( static-user !alsa !gtk !jack !opengl !pam !pulseaudio !plugins !rbd !snappy !udev )
-	static-user? ( !plugins )
-	virgl? ( opengl )
-	virtfs? ( xattr )
-	vnc? ( gnutls )
-	vte? ( gtk )
-	multipath? ( udev )
-	plugins? ( !static !static-user )
-"
-for smname in ${IUSE_SOFTMMU_TARGETS} ; do
-	REQUIRED_USE+=" qemu_softmmu_targets_${smname}? ( seccomp ) "
-done
-
-# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
-# and user/softmmu targets (qemu-*, qemu-system-*).
-#
-# Yep, you need both libcap and libcap-ng since virtfs only uses libcap.
-#
-# The attr lib isn't always linked in (although the USE flag is always
-# respected).  This is because qemu supports using the C library's API
-# when available rather than always using the external library.
-ALL_DEPEND="
-	dev-libs/glib:2[static-libs(+)]
-	sys-libs/zlib[static-libs(+)]
-	python? ( ${PYTHON_DEPS} )
-	systemtap? ( dev-debug/systemtap )
-	xattr? ( sys-apps/attr[static-libs(+)] )"
-
-# Dependencies required for qemu tools (qemu-nbd, qemu-img, qemu-io, ...)
-# softmmu targets (qemu-system-*).
-SOFTMMU_TOOLS_DEPEND="
-	sys-libs/libcap-ng[static-libs(+)]
-	>=x11-libs/pixman-0.28.0[static-libs(+)]
-	accessibility? (
-		app-accessibility/brltty[api]
-		app-accessibility/brltty[static-libs(+)]
-	)
-	aio? ( dev-libs/libaio[static-libs(+)] )
-	alsa? ( >=media-libs/alsa-lib-1.0.13 )
-	bpf? ( dev-libs/libbpf:= )
-	bzip2? ( app-arch/bzip2[static-libs(+)] )
-	capstone? ( dev-libs/capstone:=[static-libs(+)] )
-	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
-	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
-	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
-	gnutls? (
-		>=net-libs/gnutls-3.0:=[static-libs(+)]
-		dev-libs/nettle:=[static-libs(+)]
-	)
-	gtk? (
-		x11-libs/cairo
-		x11-libs/gdk-pixbuf:2
-		x11-libs/gtk+:3
-		x11-libs/libX11
-		vte? ( x11-libs/vte:2.91 )
-	)
-	infiniband? ( sys-cluster/rdma-core[static-libs(+)] )
-	iscsi? ( net-libs/libiscsi )
-	io-uring? ( sys-libs/liburing:=[static-libs(+)] )
-	jack? ( virtual/jack )
-	jemalloc? ( dev-libs/jemalloc )
-	jpeg? ( media-libs/libjpeg-turbo:=[static-libs(+)] )
-	lzo? ( dev-libs/lzo:2[static-libs(+)] )
-	multipath? ( sys-fs/multipath-tools )
-	ncurses? (
-		sys-libs/ncurses:=[unicode(+)]
-		sys-libs/ncurses:=[static-libs(+)]
-	)
-	nfs? ( >=net-fs/libnfs-1.9.3:=[static-libs(+)] )
-	numa? ( sys-process/numactl[static-libs(+)] )
-	opengl? (
-		virtual/opengl
-		media-libs/libepoxy[static-libs(+)]
-		media-libs/mesa[static-libs(+)]
-		media-libs/mesa[egl(+),gbm(+)]
-	)
-	pam? ( sys-libs/pam )
-	png? ( media-libs/libpng:0=[static-libs(+)] )
-	pulseaudio? ( media-libs/libpulse )
-	rbd? ( sys-cluster/ceph )
-	sasl? ( dev-libs/cyrus-sasl[static-libs(+)] )
-	sdl? (
-		media-libs/libsdl2[video]
-		media-libs/libsdl2[static-libs(+)]
-	)
-	sdl-image? ( media-libs/sdl2-image[static-libs(+)] )
-	seccomp? ( >=sys-libs/libseccomp-2.1.0[static-libs(+)] )
-	slirp? ( net-libs/libslirp[static-libs(+)] )
-	smartcard? ( >=app-emulation/libcacard-2.5.0[static-libs(+)] )
-	snappy? ( app-arch/snappy:= )
-	spice? (
-		>=app-emulation/spice-protocol-0.12.3
-		>=app-emulation/spice-0.12.0[static-libs(+)]
-	)
-	ssh? ( >=net-libs/libssh-0.8.6[static-libs(+)] )
-	udev? ( virtual/libudev:= )
-	usb? ( >=virtual/libusb-1-r2:1[static-libs(+)] )
-	usbredir? ( >=sys-apps/usbredir-0.6[static-libs(+)] )
-	vde? ( net-misc/vde[static-libs(+)] )
-	virgl? ( media-libs/virglrenderer[static-libs(+)] )
-	virtfs? ( sys-libs/libcap )
-	xen? ( app-emulation/xen-tools:= )
-	zstd? ( >=app-arch/zstd-1.4.0[static-libs(+)] )
-"
-
-EDK2_OVMF_VERSION="202202"
-SEABIOS_VERSION="1.16.0"
-
-X86_FIRMWARE_DEPEND="
-	pin-upstream-blobs? (
-		~sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		~sys-firmware/ipxe-1.21.1[binary,qemu]
-		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
-		~sys-firmware/sgabios-0.1_pre10[binary]
-	)
-	!pin-upstream-blobs? (
-		|| (
-			>=sys-firmware/edk2-${EDK2_OVMF_VERSION}
-			>=sys-firmware/edk2-bin-${EDK2_OVMF_VERSION}
-		)
-		sys-firmware/ipxe[qemu]
-		|| (
-			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
-			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
-		)
-		sys-firmware/sgabios
-	)"
-PPC_FIRMWARE_DEPEND="
-	pin-upstream-blobs? (
-		~sys-firmware/seabios-bin-${SEABIOS_VERSION}
-	)
-	!pin-upstream-blobs? (
-		|| (
-			>=sys-firmware/seabios-${SEABIOS_VERSION}[seavgabios]
-			>=sys-firmware/seabios-bin-${SEABIOS_VERSION}
-		)
-	)
-"
-
-BDEPEND="
-	$(python_gen_impl_dep)
-	dev-lang/perl
-	dev-build/meson
-	sys-apps/texinfo
-	virtual/pkgconfig
-	doc? (
-		dev-python/sphinx[${PYTHON_USEDEP}]
-		dev-python/sphinx-rtd-theme[${PYTHON_USEDEP}]
-	)
-	gtk? ( nls? ( sys-devel/gettext ) )
-	test? (
-		dev-libs/glib[utils]
-		app-alternatives/bc
-	)
-"
-CDEPEND="
-	!static? (
-		${ALL_DEPEND//\[static-libs(+)]}
-		${SOFTMMU_TOOLS_DEPEND//\[static-libs(+)]}
-	)
-	qemu_softmmu_targets_i386? ( ${X86_FIRMWARE_DEPEND} )
-	qemu_softmmu_targets_x86_64? ( ${X86_FIRMWARE_DEPEND} )
-	qemu_softmmu_targets_ppc? ( ${PPC_FIRMWARE_DEPEND} )
-	qemu_softmmu_targets_ppc64? ( ${PPC_FIRMWARE_DEPEND} )
-"
-DEPEND="${CDEPEND}
-	kernel_linux? ( >=sys-kernel/linux-headers-2.6.35 )
-	static? (
-		${ALL_DEPEND}
-		${SOFTMMU_TOOLS_DEPEND}
-	)
-	static-user? ( ${ALL_DEPEND} )"
-RDEPEND="${CDEPEND}
-	acct-group/kvm
-	selinux? (
-		sec-policy/selinux-qemu
-		sys-libs/libselinux
-	)"
-
-PATCHES=(
-	"${FILESDIR}"/${PN}-5.2.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-6.0.0-make.patch
-	"${FILESDIR}"/${PN}-7.1.0-also-build-virtfs-proxy-helper.patch
-	"${FILESDIR}"/${PN}-7.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-7.2.0-disable-gmp.patch
-	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
-)
-
-QA_PREBUILT="
-	usr/share/qemu/hppa-firmware.img
-	usr/share/qemu/openbios-ppc
-	usr/share/qemu/openbios-sparc64
-	usr/share/qemu/openbios-sparc32
-	usr/share/qemu/opensbi-riscv64-generic-fw_dynamic.elf
-	usr/share/qemu/opensbi-riscv32-generic-fw_dynamic.elf
-	usr/share/qemu/palcode-clipper
-	usr/share/qemu/s390-ccw.img
-	usr/share/qemu/s390-netboot.img
-	usr/share/qemu/u-boot.e500
-"
-
-QA_WX_LOAD="usr/bin/qemu-i386
-	usr/bin/qemu-x86_64
-	usr/bin/qemu-alpha
-	usr/bin/qemu-arm
-	usr/bin/qemu-cris
-	usr/bin/qemu-m68k
-	usr/bin/qemu-microblaze
-	usr/bin/qemu-microblazeel
-	usr/bin/qemu-mips
-	usr/bin/qemu-mipsel
-	usr/bin/qemu-or1k
-	usr/bin/qemu-ppc
-	usr/bin/qemu-ppc64
-	usr/bin/qemu-sh4
-	usr/bin/qemu-sh4eb
-	usr/bin/qemu-sparc
-	usr/bin/qemu-sparc64
-	usr/bin/qemu-armeb
-	usr/bin/qemu-sparc32plus
-	usr/bin/qemu-s390x
-	usr/bin/qemu-unicore32
-"
-
-DOC_CONTENTS="If you don't have kvm compiled into the kernel, make sure you have the
-kernel module loaded before running kvm. The easiest way to ensure that the
-kernel module is loaded is to load it on boot.
-	For AMD CPUs the module is called 'kvm-amd'.
-	For Intel CPUs the module is called 'kvm-intel'.
-Please review /etc/conf.d/modules for how to load these.
-
-Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
-then have <USER> re-login.
-
-For brand new installs, the default permissions on /dev/kvm might not let
-you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
-
-If you want to register binfmt handlers for qemu user targets:
-For openrc:
-	# rc-update add qemu-binfmt
-For systemd:
-	# ln -s /usr/share/qemu/binfmt.d/qemu.conf /etc/binfmt.d/qemu.conf"
-
-pkg_pretend() {
-	if use kernel_linux && kernel_is lt 2 6 25; then
-		eerror "This version of KVM requires a host kernel of 2.6.25 or higher."
-	elif use kernel_linux; then
-		if ! linux_config_exists; then
-			eerror "Unable to check your kernel for KVM support"
-		else
-			CONFIG_CHECK="~KVM ~TUN ~BRIDGE"
-			ERROR_KVM="You must enable KVM in your kernel to continue"
-			ERROR_KVM_AMD="If you have an AMD CPU, you must enable KVM_AMD in"
-			ERROR_KVM_AMD+=" your kernel configuration."
-			ERROR_KVM_INTEL="If you have an Intel CPU, you must enable"
-			ERROR_KVM_INTEL+=" KVM_INTEL in your kernel configuration."
-			ERROR_TUN="You will need the Universal TUN/TAP driver compiled"
-			ERROR_TUN+=" into your kernel or loaded as a module to use the"
-			ERROR_TUN+=" virtual network device if using -net tap."
-			ERROR_BRIDGE="You will also need support for 802.1d"
-			ERROR_BRIDGE+=" Ethernet Bridging for some network configurations."
-			use vhost-net && CONFIG_CHECK+=" ~VHOST_NET"
-			ERROR_VHOST_NET="You must enable VHOST_NET to have vhost-net"
-			ERROR_VHOST_NET+=" support"
-
-			if use amd64 || use x86 || use amd64-linux || use x86-linux; then
-				if grep -q AuthenticAMD /proc/cpuinfo; then
-					CONFIG_CHECK+=" ~KVM_AMD"
-				elif grep -q GenuineIntel /proc/cpuinfo; then
-					CONFIG_CHECK+=" ~KVM_INTEL"
-				fi
-			fi
-
-			use python && CONFIG_CHECK+=" ~DEBUG_FS"
-			ERROR_DEBUG_FS="debugFS support required for kvm_stat"
-
-			# Now do the actual checks setup above
-			check_extra_config
-		fi
-	fi
-
-	if grep -qs '/usr/bin/qemu-kvm' "${EROOT}"/etc/libvirt/qemu/*.xml; then
-		eerror "The kvm/qemu-kvm wrappers no longer exist, but your libvirt"
-		eerror "instances are still pointing to it.  Please update your"
-		eerror "configs in /etc/libvirt/qemu/ to use the -enable-kvm flag"
-		eerror "and the right system binary (e.g. qemu-system-x86_64)."
-		die "update your virt configs to not use qemu-kvm"
-	fi
-}
-
-# Sanity check to make sure target lists are kept up-to-date.
-check_targets() {
-	local var=$1 mak=$2
-	local detected sorted
-
-	pushd "${S}"/configs/targets/ >/dev/null || die
-
-	# Force C locale until glibc is updated. #564936
-	detected=$(echo $(printf '%s\n' *-${mak}.mak | sed "s:-${mak}.mak::" | LC_COLLATE=C sort -u))
-	sorted=$(echo $(printf '%s\n' ${!var} | LC_COLLATE=C sort -u))
-	if [[ ${sorted} != "${detected}" ]] ; then
-		eerror "The ebuild needs to be kept in sync."
-		eerror "${var}: ${sorted}"
-		eerror "$(printf '%-*s' ${#var} configure): ${detected}"
-		die "sync ${var} to the list of targets"
-	fi
-
-	popd >/dev/null
-}
-
-src_prepare() {
-	check_targets IUSE_SOFTMMU_TARGETS softmmu
-	check_targets IUSE_USER_TARGETS linux-user
-
-	default
-
-	# Use correct toolchain to fix cross-compiling
-	tc-export AR AS LD NM OBJCOPY PKG_CONFIG RANLIB STRINGS
-	export WINDRES=${CHOST}-windres
-
-	# Workaround for bug #938302
-	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
-		cat >> "${S}"/configs/meson/linux.txt <<-EOF || die
-		[binaries]
-		dtrace='stap-dtrace'
-		EOF
-	fi
-
-	# Verbose builds
-	MAKEOPTS+=" V=1"
-
-	# We already force -D_FORTIFY_SOURCE=2 (or 3) in our toolchain, but
-	# this setting (-U then -D..=2) will prevent us from trying out 3, so
-	# drop it. No change to level of protection b/c we patch our toolchain.
-	sed -i -e 's/-U_FORTIFY_SOURCE -D_FORTIFY_SOURCE=2//' configure || die
-
-	# Remove bundled modules
-	rm -r dtc meson roms/*/ || die
-}
-
-##
-# configures qemu based on the build directory and the build type
-# we are using.
-#
-qemu_src_configure() {
-	debug-print-function ${FUNCNAME} "$@"
-
-	local buildtype=$1
-	local builddir="${S}/${buildtype}-build"
-
-	mkdir "${builddir}" || die
-
-	local conf_opts=(
-		--prefix=/usr
-		--sysconfdir=/etc
-		--bindir=/usr/bin
-		--libdir=/usr/$(get_libdir)
-		--datadir=/usr/share
-		--docdir=/usr/share/doc/${PF}/html
-		--mandir=/usr/share/man
-		--localstatedir=/var
-		--disable-bsd-user
-		--disable-containers # bug #732972
-		--disable-guest-agent
-		--disable-strip
-		--with-git-submodules=ignore
-
-		# bug #746752: TCG interpreter has a few limitations:
-		# - it does not support FPU
-		# - it's generally slower on non-self-modifying code
-		# It's advantage is support for host architectures
-		# where native codegeneration is not implemented.
-		# Gentoo has qemu keyworded only on targets with
-		# native code generation available. Avoid the interpreter.
-		--disable-tcg-interpreter
-
-		--disable-werror
-		# We support gnutls/nettle for crypto operations.  It is possible
-		# to use gcrypt when gnutls/nettle are disabled (but not when they
-		# are enabled), but it's not really worth the hassle.  Disable it
-		# all the time to avoid automatically detecting it. #568856
-		--disable-gcrypt
-		--cc="$(tc-getCC)"
-		--cxx="$(tc-getCXX)"
-		--host-cc="$(tc-getBUILD_CC)"
-
-		$(use_enable alsa)
-		$(use_enable debug debug-info)
-		$(use_enable debug debug-tcg)
-		$(use_enable jack)
-		$(use_enable nls gettext)
-		$(use_enable oss)
-		$(use_enable plugins)
-		$(use_enable pulseaudio pa)
-		$(use_enable selinux)
-		$(use_enable xattr attr)
-	)
-
-	# Disable options not used by user targets. This simplifies building
-	# static user targets (USE=static-user) considerably.
-	conf_notuser() {
-		if [[ ${buildtype} == "user" ]] ; then
-			echo "--disable-${2:-$1}"
-		else
-			use_enable "$@"
-		fi
-	}
-	# Enable option only for softmmu build, but not 'user' or 'tools'
-	conf_softmmu() {
-		if [[ ${buildtype} == "softmmu" ]] ; then
-			use_enable "$@"
-		else
-			echo "--disable-${2:-$1}"
-		fi
-	}
-	# Enable option only for tools build, but not 'user' or 'softmmu'
-	conf_tools() {
-		if [[ ${buildtype} == "tools" ]] ; then
-			use_enable "$@"
-		else
-			echo "--disable-${2:-$1}"
-		fi
-	}
-	# Special case for the malloc flag, because the --disable flag does
-	# not exist and trying like above will break configuring.
-	conf_malloc() {
-		if [[ ! ${buildtype} == "user" ]] ; then
-			usex "${1}" "--enable-malloc=${1}" ""
-		fi
-	}
-	conf_opts+=(
-		$(conf_notuser accessibility brlapi)
-		$(conf_notuser aio linux-aio)
-		$(conf_softmmu bpf)
-		$(conf_notuser bzip2)
-		$(conf_notuser capstone)
-		$(conf_notuser curl)
-		$(conf_tools doc docs)
-		$(conf_notuser fdt)
-		$(conf_notuser fuse)
-		$(conf_notuser glusterfs)
-		$(conf_notuser gnutls)
-		$(conf_notuser gnutls nettle)
-		$(conf_notuser gtk)
-		$(conf_notuser infiniband rdma)
-		$(conf_notuser iscsi libiscsi)
-		$(conf_notuser io-uring linux-io-uring)
-		$(conf_malloc jemalloc)
-		$(conf_notuser jpeg vnc-jpeg)
-		$(conf_notuser kernel_linux kvm)
-		$(conf_notuser lzo)
-		$(conf_notuser multipath mpath)
-		$(conf_notuser ncurses curses)
-		$(conf_notuser nfs libnfs)
-		$(conf_notuser numa)
-		$(conf_notuser opengl)
-		$(conf_notuser pam auth-pam)
-		$(conf_notuser png)
-		$(conf_notuser rbd)
-		$(conf_notuser sasl vnc-sasl)
-		$(conf_notuser sdl)
-		$(conf_softmmu sdl-image)
-		$(conf_notuser seccomp)
-		$(conf_notuser slirp)
-		$(conf_notuser smartcard)
-		$(conf_notuser snappy)
-		$(conf_notuser spice)
-		$(conf_notuser ssh libssh)
-		$(conf_notuser udev libudev)
-		$(conf_notuser usb libusb)
-		$(conf_notuser usbredir usb-redir)
-		$(conf_notuser vde)
-		$(conf_notuser vhost-net)
-		$(conf_notuser virgl virglrenderer)
-		$(conf_softmmu virtfs)
-		$(conf_notuser vnc)
-		$(conf_notuser vte)
-		$(conf_notuser xen)
-		$(conf_notuser xen xen-pci-passthrough)
-		# use prebuilt keymaps, bug #759604
-		--disable-xkbcommon
-		$(conf_notuser zstd)
-	)
-
-	if [[ ! ${buildtype} == "user" ]] ; then
-		# audio options
-		local audio_opts=(
-			# Note: backend order matters here: #716202
-			# We iterate from higher-level to lower level.
-			$(usex pulseaudio pa "")
-			$(usev jack)
-			$(usev sdl)
-			$(usev alsa)
-			$(usev oss)
-		)
-		conf_opts+=(
-			--audio-drv-list=$(IFS=,; echo "${audio_opts[*]}")
-		)
-	fi
-
-	case ${buildtype} in
-	user)
-		conf_opts+=(
-			--enable-linux-user
-			--disable-system
-			--disable-blobs
-			--disable-tools
-			--disable-cap-ng
-			--disable-seccomp
-		)
-		local static_flag="static-user"
-		;;
-	softmmu)
-		conf_opts+=(
-			--disable-linux-user
-			--enable-system
-			--disable-tools
-			--enable-cap-ng
-			--enable-seccomp
-		)
-		local static_flag="static"
-		;;
-	tools)
-		conf_opts+=(
-			--disable-linux-user
-			--disable-system
-			--disable-blobs
-			--enable-tools
-			--enable-cap-ng
-		)
-		local static_flag="static"
-		;;
-	esac
-
-	local targets="${buildtype}_targets"
-	[[ -n ${targets} ]] && conf_opts+=( --target-list="${!targets}" )
-
-	# Add support for SystemTap
-	use systemtap && conf_opts+=( --enable-trace-backend=dtrace )
-
-	# We always want to attempt to build with PIE support as it results
-	# in a more secure binary. But it doesn't work with static or if
-	# the current GCC doesn't have PIE support.
-	if use ${static_flag}; then
-		conf_opts+=( --static --disable-pie )
-	else
-		tc-enables-pie && conf_opts+=( --enable-pie )
-	fi
-
-	# Meson will not use a cross-file unless cross_prefix is set.
-	tc-is-cross-compiler && conf_opts+=( --cross-prefix="${CHOST}-" )
-
-	# Plumb through equivalent of EXTRA_ECONF to allow experiments
-	# like bug #747928.
-	conf_opts+=( ${EXTRA_CONF_QEMU} )
-
-	echo "../configure ${conf_opts[*]}"
-	cd "${builddir}"
-	../configure "${conf_opts[@]}" || die "configure failed"
-}
-
-src_configure() {
-	local target
-
-	python_setup
-
-	softmmu_targets= softmmu_bins=()
-	user_targets= user_bins=()
-
-	for target in ${IUSE_SOFTMMU_TARGETS} ; do
-		if use "qemu_softmmu_targets_${target}"; then
-			softmmu_targets+=",${target}-softmmu"
-			softmmu_bins+=( "qemu-system-${target}" )
-		fi
-	done
-
-	for target in ${IUSE_USER_TARGETS} ; do
-		if use "qemu_user_targets_${target}"; then
-			user_targets+=",${target}-linux-user"
-			user_bins+=( "qemu-${target}" )
-		fi
-	done
-
-	softmmu_targets=${softmmu_targets#,}
-	user_targets=${user_targets#,}
-
-	[[ -n ${softmmu_targets} ]] && qemu_src_configure "softmmu"
-	[[ -n ${user_targets}    ]] && qemu_src_configure "user"
-	qemu_src_configure "tools"
-}
-
-src_compile() {
-	if [[ -n ${user_targets} ]]; then
-		cd "${S}/user-build" || die
-		default
-	fi
-
-	if [[ -n ${softmmu_targets} ]]; then
-		cd "${S}/softmmu-build" || die
-		default
-	fi
-
-	cd "${S}/tools-build" || die
-	default
-}
-
-src_test() {
-	if [[ -n ${softmmu_targets} ]]; then
-		cd "${S}/softmmu-build" || die
-		pax-mark m */qemu-system-* #515550
-		emake check
-	fi
-}
-
-qemu_python_install() {
-	python_domodule "${S}/python/qemu"
-
-	python_doscript "${S}/scripts/kvm/vmxcap"
-	python_doscript "${S}/scripts/qmp/qmp-shell"
-	python_doscript "${S}/scripts/qmp/qemu-ga-client"
-}
-
-# Generate binfmt support files.
-#   - /etc/init.d/qemu-binfmt script which registers the user handlers (openrc)
-#   - /usr/share/qemu/binfmt.d/qemu.conf (for use with systemd-binfmt)
-generate_initd() {
-	local out="${T}/qemu-binfmt"
-	local out_systemd="${T}/qemu.conf"
-	local d="${T}/binfmt.d"
-
-	einfo "Generating qemu binfmt scripts and configuration files"
-
-	# Generate the debian fragments first.
-	mkdir -p "${d}"
-	"${S}"/scripts/qemu-binfmt-conf.sh \
-		--debian \
-		--exportdir "${d}" \
-		--qemu-path "${EPREFIX}/usr/bin" \
-		|| die
-	# Then turn the fragments into a shell script we can source.
-	sed -E -i \
-		-e 's:^([^ ]+) (.*)$:\1="\2":' \
-		"${d}"/* || die
-
-	# Generate the init.d script by assembling the fragments from above.
-	local f qcpu package interpreter magic mask
-	cat "${FILESDIR}"/qemu-binfmt.initd.head >"${out}" || die
-	for f in "${d}"/qemu-* ; do
-		source "${f}"
-
-		# Normalize the cpu logic like we do in the init.d for the native cpu.
-		qcpu=${package#qemu-}
-		case ${qcpu} in
-		arm*)   qcpu="arm";;
-		mips*)  qcpu="mips";;
-		ppc*)   qcpu="ppc";;
-		s390*)  qcpu="s390";;
-		sh*)    qcpu="sh";;
-		sparc*) qcpu="sparc";;
-		esac
-
-		# we use 'printf' here to be portable across 'sh'
-		# implementations: #679168
-		cat <<EOF >>"${out}"
-	if [ "\${cpu}" != "${qcpu}" -a -x "${interpreter}" ] ; then
-		printf '%s\n' ':${package}:M::${magic}:${mask}:${interpreter}:'"\${QEMU_BINFMT_FLAGS}" >/proc/sys/fs/binfmt_misc/register
-	fi
-EOF
-
-		echo ":${package}:M::${magic}:${mask}:${interpreter}:OC" >>"${out_systemd}"
-
-	done
-	cat "${FILESDIR}"/qemu-binfmt.initd.tail >>"${out}" || die
-}
-
-src_install() {
-	if [[ -n ${user_targets} ]]; then
-		cd "${S}/user-build"
-		emake DESTDIR="${ED}" install
-
-		# Install binfmt handler init script for user targets.
-		generate_initd
-		doinitd "${T}/qemu-binfmt"
-
-		# Install binfmt/qemu.conf.
-		insinto "/usr/share/qemu/binfmt.d"
-		doins "${T}/qemu.conf"
-	fi
-
-	if [[ -n ${softmmu_targets} ]]; then
-		cd "${S}/softmmu-build"
-		emake DESTDIR="${ED}" install
-
-		# This might not exist if the test failed. #512010
-		[[ -e check-report.html ]] && dodoc check-report.html
-
-		if use kernel_linux; then
-			udev_newrules "${FILESDIR}"/65-kvm.rules-r2 65-kvm.rules
-		fi
-
-		if use python; then
-			python_foreach_impl qemu_python_install
-		fi
-	fi
-
-	cd "${S}/tools-build" || die
-	emake DESTDIR="${ED}" install
-
-	# If USE=doc, there'll be newly generated docs which we install instead.
-	if ! use doc && [[ ${QEMU_DOCS_PREBUILT} == 1 ]] ; then
-		doman "${WORKDIR}"/${PN}-${QEMU_DOCS_VERSION}-docs/docs/*.[0-8]
-	fi
-
-	# Disable mprotect on the qemu binaries as they use JITs to be fast #459348
-	pushd "${ED}"/usr/bin >/dev/null || die
-	pax-mark mr "${softmmu_bins[@]}" "${user_bins[@]}" # bug 575594
-	popd >/dev/null || die
-
-	# Install config file example for qemu-bridge-helper
-	insinto "/etc/qemu"
-	doins "${FILESDIR}/bridge.conf"
-
-	cd "${S}" || die
-	dodoc MAINTAINERS docs/specs/pci-ids.txt
-	newdoc pc-bios/README README.pc-bios
-
-	# Disallow stripping of prebuilt firmware files.
-	dostrip -x ${QA_PREBUILT}
-
-	if [[ -n ${softmmu_targets} ]]; then
-		# Remove SeaBIOS since we're using the SeaBIOS packaged one
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
-			dosym ../seabios/bios-256k.bin /usr/share/qemu/bios-256k.bin
-		fi
-
-		# Remove vgabios since we're using the seavgabios packaged one
-		rm "${ED}/usr/share/qemu/vgabios.bin"
-		rm "${ED}/usr/share/qemu/vgabios-cirrus.bin"
-		rm "${ED}/usr/share/qemu/vgabios-qxl.bin"
-		rm "${ED}/usr/share/qemu/vgabios-stdvga.bin"
-		rm "${ED}/usr/share/qemu/vgabios-virtio.bin"
-		rm "${ED}/usr/share/qemu/vgabios-vmware.bin"
-
-		# PPC/PPC64 loads vgabios-stdvga
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386 || use qemu_softmmu_targets_ppc || use qemu_softmmu_targets_ppc64; then
-			dosym ../seavgabios/vgabios-isavga.bin /usr/share/qemu/vgabios.bin
-			dosym ../seavgabios/vgabios-cirrus.bin /usr/share/qemu/vgabios-cirrus.bin
-			dosym ../seavgabios/vgabios-qxl.bin /usr/share/qemu/vgabios-qxl.bin
-			dosym ../seavgabios/vgabios-stdvga.bin /usr/share/qemu/vgabios-stdvga.bin
-			dosym ../seavgabios/vgabios-virtio.bin /usr/share/qemu/vgabios-virtio.bin
-			dosym ../seavgabios/vgabios-vmware.bin /usr/share/qemu/vgabios-vmware.bin
-		fi
-
-		# Remove sgabios since we're using the sgabios packaged one
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
-			dosym ../sgabios/sgabios.bin /usr/share/qemu/sgabios.bin
-		fi
-
-		# Remove iPXE since we're using the iPXE packaged one
-		if use qemu_softmmu_targets_x86_64 || use qemu_softmmu_targets_i386; then
-			dosym ../ipxe/8086100e.rom /usr/share/qemu/pxe-e1000.rom
-			dosym ../ipxe/80861209.rom /usr/share/qemu/pxe-eepro100.rom
-			dosym ../ipxe/10500940.rom /usr/share/qemu/pxe-ne2k_pci.rom
-			dosym ../ipxe/10222000.rom /usr/share/qemu/pxe-pcnet.rom
-			dosym ../ipxe/10ec8139.rom /usr/share/qemu/pxe-rtl8139.rom
-			dosym ../ipxe/1af41000.rom /usr/share/qemu/pxe-virtio.rom
-		fi
-	fi
-
-	DISABLE_AUTOFORMATTING=true
-	readme.gentoo_create_doc
-}
-
-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
-pkg_postinst() {
-	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
-		udev_reload
-	fi
-
-	xdg_icon_cache_update
-
-	[[ -z ${EPREFIX} ]] && [[ -f ${EROOT}/usr/libexec/qemu-bridge-helper ]] && \
-		fcaps cap_net_admin "${EROOT}"/usr/libexec/qemu-bridge-helper
-
-	DISABLE_AUTOFORMATTING=true
-	readme.gentoo_print_elog
-
-	if use pin-upstream-blobs && firmware_abi_change; then
-		ewarn "This version of qemu pins new versions of firmware blobs:"
-
-		if has_version 'sys-firmware/edk2-bin'; then
-			ewarn "	$(best_version sys-firmware/edk2-bin)"
-		else
-			ewarn " $(best_version sys-firmware/edk2)"
-		fi
-
-		if has_version 'sys-firmware/seabios-bin'; then
-			ewarn "	$(best_version sys-firmware/seabios-bin)"
-		else
-			ewarn " $(best_version sys-firmware/seabios)"
-		fi
-
-		ewarn "	$(best_version sys-firmware/ipxe)"
-		ewarn "	$(best_version sys-firmware/sgabios)"
-		ewarn "This might break resume of hibernated guests (started with a different"
-		ewarn "firmware version) and live migration to/from qemu versions with different"
-		ewarn "firmware. Please (cold) restart all running guests. For functional"
-		ewarn "guest migration ensure that all"
-		ewarn "hosts run at least"
-		ewarn "	app-emulation/qemu-${FIRMWARE_ABI_VERSION}."
-	fi
-}
-
-pkg_info() {
-	echo "Using:"
-	echo "  $(best_version app-emulation/spice-protocol)"
-
-	if has_version 'sys-firmware/edk2-bin'; then
-		echo "  $(best_version sys-firmware/edk2-bin)"
-	else
-		echo "  $(best_version sys-firmware/edk2)"
-	fi
-
-	if has_version 'sys-firmware/seabios-bin'; then
-		echo "  $(best_version sys-firmware/seabios-bin)"
-	else
-		echo "  $(best_version sys-firmware/seabios)"
-	fi
-
-	echo "  $(best_version sys-firmware/ipxe)"
-	echo "  $(best_version sys-firmware/sgabios)"
-}
-
-pkg_postrm() {
-	xdg_icon_cache_update
-	udev_reload
-}

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-8.2.10-r1.ebuild

@@ -320,6 +320,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-8.1.0-also-build-virtfs-proxy-helper.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.1.3-r2.ebuild

@@ -178,7 +178,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
@@ -322,7 +322,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
 	"${FILESDIR}"/${PN}-9.0.0-glibc-2.41.patch
-
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.3-r3.ebuild

@@ -18,8 +18,8 @@ PYTHON_REQ_USE="ensurepip(-),ncurses,readline"
 
 FIRMWARE_ABI_VERSION="7.2.0"
 
-inherit flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps readme.gentoo-r1 \
-		pax-utils xdg-utils
+inherit eapi9-ver flag-o-matic linux-info toolchain-funcs python-r1 udev fcaps \
+		readme.gentoo-r1 pax-utils xdg-utils
 
 if [[ ${PV} == *9999* ]]; then
 	QEMU_DOCS_PREBUILT=0
@@ -47,7 +47,7 @@ else
 	fi
 
 	S="${WORKDIR}/${MY_P}"
-	[[ "${PV}" != *_rc* ]] && KEYWORDS="~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~x86"
+	[[ "${PV}" != *_rc* ]] && KEYWORDS="amd64 ~arm arm64 ~loong ~ppc ppc64 ~riscv x86"
 fi
 
 DESCRIPTION="QEMU + Kernel-based Virtual Machine userland tools"
@@ -73,7 +73,6 @@ COMMON_TARGETS="
 	aarch64
 	alpha
 	arm
-	cris
 	hppa
 	i386
 	loongarch64
@@ -178,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
@@ -289,8 +288,9 @@ BDEPEND="
 	)
 	gtk? ( nls? ( sys-devel/gettext ) )
 	test? (
-		dev-libs/glib[utils]
 		app-alternatives/bc
+		dev-libs/glib[utils]
+		dev-python/pycotap[${PYTHON_USEDEP}]
 	)
 "
 CDEPEND="
@@ -317,12 +317,11 @@ RDEPEND="
 
 PATCHES=(
 	"${FILESDIR}"/${PN}-9.0.0-disable-keymap.patch
-	"${FILESDIR}"/${PN}-9.1.0-capstone-include-path.patch
-	"${FILESDIR}"/${PN}-9.0.0-also-build-virtfs-proxy-helper.patch
+	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
-	"${FILESDIR}"/${PN}-9.0.0-glibc-2.41.patch
 	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
+	"${FILESDIR}"/${PN}-9.2.3-virtio-net.patch
 )
 
 QA_PREBUILT="
@@ -481,8 +480,8 @@ src_prepare() {
 	export WINDRES=${CHOST}-windres
 
 	# defang automagic dependencies
-	use X || append-cppflags -DGENTOO_GTK_HIDE_X11
-	use wayland || append-cppflags -DGENTOO_GTK_HIDE_WAYLAND
+	use X || append-flags -DGENTOO_GTK_HIDE_X11
+	use wayland || append-flags -DGENTOO_GTK_HIDE_WAYLAND
 
 	# Workaround for bug #938302
 	if use systemtap && has_version "dev-debug/systemtap[-dtrace-symlink(+)]" ; then
@@ -683,6 +682,7 @@ qemu_src_configure() {
 			--disable-tools
 			--enable-cap-ng
 			--enable-seccomp
+			--disable-libcbor
 		)
 		local static_flag="none"
 		;;
@@ -936,16 +936,6 @@ src_install() {
 	readme.gentoo_create_doc
 }
 
-firmware_abi_change() {
-	local pv
-	for pv in ${REPLACING_VERSIONS}; do
-		if ver_test ${pv} -lt ${FIRMWARE_ABI_VERSION}; then
-			return 0
-		fi
-	done
-	return 1
-}
-
 pkg_postinst() {
 	if [[ -n ${softmmu_targets} ]] && use kernel_linux; then
 		udev_reload
@@ -959,7 +949,7 @@ pkg_postinst() {
 	DISABLE_AUTOFORMATTING=true
 	readme.gentoo_print_elog
 
-	if use pin-upstream-blobs && firmware_abi_change; then
+	if use pin-upstream-blobs && ver_replacing -lt ${FIRMWARE_ABI_VERSION}; then
 		ewarn "This version of qemu pins new versions of firmware blobs:"
 
 		if has_version 'sys-firmware/edk2-bin'; then

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9.2.4.ebuild

@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]

sdk_container/src/third_party/portage-stable/app-emulation/qemu/qemu-9999.ebuild

@@ -177,7 +177,7 @@ SOFTMMU_TOOLS_DEPEND="
 	capstone? ( dev-libs/capstone:=[static-libs(+)] )
 	curl? ( >=net-misc/curl-7.15.4[static-libs(+)] )
 	fdt? ( >=sys-apps/dtc-1.5.1[static-libs(+)] )
-	fuse? ( >=sys-fs/fuse-3.1:3[static-libs(+)] )
+	fuse? ( >=sys-fs/fuse-3.1:3=[static-libs(+)] )
 	glusterfs? ( >=sys-cluster/glusterfs-3.4.0[static-libs(+)] )
 	gnutls? (
 		>=net-libs/gnutls-3.0:=[static-libs(+)]
@@ -320,7 +320,7 @@ PATCHES=(
 	"${FILESDIR}"/${PN}-9.2.0-capstone-include-path.patch
 	"${FILESDIR}"/${PN}-8.1.0-skip-tests.patch
 	"${FILESDIR}"/${PN}-8.1.0-find-sphinx.patch
-
+	"${FILESDIR}"/${PN}-7.2.16-optionrom-pass-Wl-no-error-rwx-segments.patch
 )
 
 QA_PREBUILT="
@@ -369,12 +369,12 @@ kernel module is loaded is to load it on boot.
 Please review /etc/conf.d/modules for how to load these.
 
 Make sure your user is in the 'kvm' group. Just run
-	$ gpasswd -a <USER> kvm
+	# gpasswd -a <USER> kvm
 then have <USER> re-login.
 
 For brand new installs, the default permissions on /dev/kvm might not let
 you access it.  You can tell udev to reset ownership/perms:
-	$ udevadm trigger -c add /dev/kvm
+	# udevadm trigger -c add /dev/kvm
 
 If you want to register binfmt handlers for qemu user targets:
 For openrc:

sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/Manifest

@@ -1,2 +1,2 @@
 DIST virt_firmware-24.11.tar.gz 115385 BLAKE2B 2edfe718fd60dcd8a13b143f9fcf5f6beb604737ef4855cb0f16376e625f5bf2965bb08b7ddd037a6b8b6420c928abceefe1034135ab66763695fa8c359786b5 SHA512 0c6b4d34d518835b4489404c784b263cd6ac8348834ba654d27ae3741d3d229ea5f6036870399390fa4fa33e01c8113d64faba0c6068e4b2fb5bbdd9429bf72f
-DIST virt_firmware-24.7.tar.gz 114229 BLAKE2B a5b6bf39a72ce68622bbc4f75505633b92c322e4a02ab0384bb3b618abfbeeb19cfb057b5333ae53042732b131dcaa475c2c920922c920b0d0c21ef4185ad5b9 SHA512 1cd209b500e0ec1a5b8284b72b499bd16e998fd9489db6c8f8e3b49befb6186c5c09c95b2761254696b479daff1afaf2bdccb6ca7e115b11eb9a5df847f43628
+DIST virt_firmware-25.4.1.tar.gz 120061 BLAKE2B ef22266944cae225cf817c9b67a7aae5ee95908be419b870f451f6eba391998be082b1cf8f2dad62ed84551323cb56854b785a93d0c0ff83340fdb9a5f571aeb SHA512 2f82299415a0bf5dd8874764fe7d71cfe9a12e489657237f6a889288294e69fed9076219ae91a2d60084ae1ffac6bc4f3e2760999e8030aad045cb59ea152367

sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-24.11.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..13} )
+PYTHON_COMPAT=( python3_{11..13} )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit distutils-r1 optfeature pypi systemd
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="~amd64 ~arm ~arm64 ~loong ~riscv ~x86"
+KEYWORDS="amd64 arm arm64 ~loong ~riscv x86"
 
 RDEPEND="
 	dev-python/cryptography[${PYTHON_USEDEP}]

sdk_container/src/third_party/portage-stable/app-emulation/virt-firmware/virt-firmware-25.4.1.ebuild

@@ -3,7 +3,7 @@
 
 EAPI=8
 
-PYTHON_COMPAT=( python3_{10..12} )
+PYTHON_COMPAT=( python3_{11..13} )
 DISTUTILS_USE_PEP517=setuptools
 
 inherit distutils-r1 optfeature pypi systemd
@@ -16,7 +16,7 @@ HOMEPAGE="
 
 LICENSE="GPL-2"
 SLOT="0"
-KEYWORDS="amd64 arm arm64 x86"
+KEYWORDS="~amd64 ~arm ~arm64 ~loong ~riscv ~x86"
 
 RDEPEND="
 	dev-python/cryptography[${PYTHON_USEDEP}]

sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-0.1.1-r1.ebuild

@@ -1,14 +1,18 @@
-# Copyright 1999-2023 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
-EAPI=7
+EAPI=8
 
 DESCRIPTION="An eselect library to manage executable symlinks"
 HOMEPAGE="https://github.com/projg2/eselect-lib-bin-symlink/"
-SRC_URI="https://github.com/projg2/eselect-lib-bin-symlink/releases/download/${P}/${P}.tar.bz2"
+SRC_URI="
+	https://github.com/projg2/eselect-lib-bin-symlink/releases/download/${P}/${P}.tar.bz2
+"
 
 LICENSE="GPL-2+"
 SLOT="0"
 KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~arm64-macos ~ppc-macos ~x64-macos ~x64-solaris"
 
-RDEPEND="app-admin/eselect"
+RDEPEND="
+	app-admin/eselect
+"

sdk_container/src/third_party/portage-stable/app-eselect/eselect-lib-bin-symlink/eselect-lib-bin-symlink-9999.ebuild

@@ -1,20 +0,0 @@
-# Copyright 1999-2023 Gentoo Authors
-# Distributed under the terms of the GNU General Public License v2
-
-EAPI=7
-
-inherit autotools git-r3
-
-DESCRIPTION="An eselect library to manage executable symlinks"
-HOMEPAGE="https://github.com/projg2/eselect-lib-bin-symlink/"
-EGIT_REPO_URI="https://github.com/projg2/eselect-lib-bin-symlink.git"
-
-LICENSE="GPL-2+"
-SLOT="0"
-
-RDEPEND="app-admin/eselect"
-
-src_prepare() {
-	default
-	eautoreconf
-}

sdk_container/src/third_party/portage-stable/app-eselect/eselect-python/eselect-python-20200719.ebuild

@@ -1,4 +1,4 @@
-# Copyright 1999-2022 Gentoo Authors
+# Copyright 1999-2025 Gentoo Authors
 # Distributed under the terms of the GNU General Public License v2
 
 EAPI=7
@@ -8,7 +8,7 @@ if [[ ${PV} == "99999999" ]] ; then
 	EGIT_REPO_URI="https://anongit.gentoo.org/proj/${PN}.git"
 else
 	SRC_URI="https://dev.gentoo.org/~chutzpah/dist/misc/${P}.tar.bz2"
-	KEYWORDS="~alpha amd64 arm arm64 hppa ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
+	KEYWORDS="~alpha amd64 arm arm64 hppa ~loong ~m68k ~mips ppc ppc64 ~riscv ~s390 sparc x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos ~x64-solaris"
 fi
 
 DESCRIPTION="Eselect module for management of multiple Python versions"

sdk_container/src/third_party/portage-stable/app-misc/jq/Manifest

@@ -1 +1,2 @@
 DIST jq-1.7.1.gh.tar.gz 1323338 BLAKE2B 17e3b68e23f9a7f1aa8749ede6c0b8fe435990899886f0c96da36d130c17d13609ba7f910321316f0c3b35985360f8cb5e6a3b12caea5e9bc7792e128798f137 SHA512 af9c444e5306423182f467a53acdf45bb8aefa058a47f490ce16395f0aebfb7627e3843f65e96f41cd9d4b72b8ad274ab0bdb061abc6990b1158f86d2256d4ec
+DIST jq-1.8.0.gh.tar.gz 1355079 BLAKE2B 0d98ed6ccf90d2d110cb3e04aa3058237f1650f246860c60a33528886374d247ba774ed64a0cf8f06b8c135ce0281b7b183732c0dfb9c267a9858df2e18b9740 SHA512 36c4035fbb5c7a6523c98d09cf8ba9636e79919f1620eb3934f4dec7ea42009ad5cce49ed67e516880911b98eb2d7188f58c75aa88359a20f848815b3c9032ee

sdk_container/src/third_party/portage-stable/app-misc/jq/jq-1.8.0.ebuild

@@ -0,0 +1,86 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+inherit autotools flag-o-matic
+
+MY_PV="${PV/_/}"
+MY_P="${PN}-${MY_PV}"
+DESCRIPTION="A lightweight and flexible command-line JSON processor"
+HOMEPAGE="https://stedolan.github.io/jq/"
+SRC_URI="https://github.com/jqlang/jq/archive/refs/tags/${MY_P}.tar.gz -> ${P}.gh.tar.gz"
+S="${WORKDIR}/${PN}-${MY_P}"
+
+LICENSE="MIT icu CC-BY-3.0"
+SLOT="0/1"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~loong ~ppc ~ppc64 ~riscv ~sparc ~x86 ~amd64-linux ~arm64-macos ~x64-macos ~x64-solaris"
+IUSE="+oniguruma static-libs test"
+
+ONIGURUMA_MINPV='>=dev-libs/oniguruma-6.9.10' # Keep this in sync with bundled vendor/oniguruma/
+DEPEND="
+	>=sys-devel/bison-3.0
+	app-alternatives/lex
+	oniguruma? ( ${ONIGURUMA_MINPV}:=[static-libs?] )
+"
+RDEPEND="
+	!static-libs? (
+		oniguruma? ( ${ONIGURUMA_MINPV}[static-libs?] )
+	)
+"
+PATCHES=(
+	"${FILESDIR}"/jq-1.6-r3-never-bundle-oniguruma.patch
+)
+
+RESTRICT="!test? ( test )"
+REQUIRED_USE="test? ( oniguruma )"
+
+src_prepare() {
+	sed -e '/^dist_doc_DATA/d; s:-Wextra ::' -i Makefile.am || die
+	printf "#!/bin/sh\\nprintf '%s'\\n\n" "${MY_PV}" > scripts/version || die
+
+	# jq-1.6-r3-never-bundle-oniguruma makes sure we build with the system oniguruma,
+	# but the bundled copy of oniguruma still gets eautoreconf'd since it
+	# exists; save the cycles by nuking it.
+	sed -e '/vendor\/oniguruma/d' -i Makefile.am || die
+	rm -rf "${S}"/vendor/oniguruma || die
+
+	default
+
+	sed -i "s/\[jq_version\]/[${MY_PV}]/" configure.ac || die
+
+	eautoreconf
+}
+
+src_configure() {
+	# TODO: Drop on next release > 1.7.1
+	# bug #944014
+	append-cflags -std=gnu17
+
+	local econfargs=(
+		# don't try to rebuild docs
+		--disable-docs
+		--enable-valgrind=no
+		--disable-maintainer-mode
+		$(use_enable static-libs static)
+		$(use_with oniguruma oniguruma yes)
+	)
+	econf "${econfargs[@]}"
+}
+
+src_test() {
+	if ! LD_LIBRARY_PATH="${S}/.libs" nonfatal emake check; then
+		if [[ -r "${S}/test-suite.log" ]]; then
+			eerror "Tests failed, outputting testsuite log"
+			cat "${S}/test-suite.log"
+		fi
+		die "Tests failed"
+	fi
+}
+
+src_install() {
+	local DOCS=( AUTHORS NEWS.md README.md SECURITY.md )
+	default
+
+	use static-libs || { find "${D}" -name '*.la' -delete || die; }
+}

sdk_container/src/third_party/portage-stable/app-shells/bash-completion/bash-completion-2.16.0-r1.ebuild

@@ -0,0 +1,170 @@
+# Copyright 1999-2025 Gentoo Authors
+# Distributed under the terms of the GNU General Public License v2
+
+EAPI=8
+
+BASHCOMP_P=bashcomp-2.0.3
+PYTHON_COMPAT=( python3_{10..13} )
+
+inherit autotools python-any-r1
+
+DESCRIPTION="Programmable Completion for bash"
+HOMEPAGE="https://github.com/scop/bash-completion"
+SRC_URI="
+	https://github.com/scop/bash-completion/releases/download/${PV}/${P}.tar.xz
+	eselect? (
+		https://github.com/projg2/bashcomp2/releases/download/v${BASHCOMP_P#*-}/${BASHCOMP_P}.tar.gz
+	)
+"
+
+LICENSE="GPL-2+"
+SLOT="0"
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~loong ~m68k ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86 ~amd64-linux ~x86-linux ~ppc-macos ~x64-macos"
+IUSE="+eselect test"
+RESTRICT="!test? ( test )"
+
+# completion collision with net-fs/mc
+RDEPEND="
+	>=app-shells/bash-4.3_p30-r1:0
+	sys-apps/miscfiles
+	!<app-text/tree-2.1.1-r1
+	!!net-fs/mc
+"
+BDEPEND="
+	test? (
+		${RDEPEND}
+		$(python_gen_any_dep '
+			dev-python/pexpect[${PYTHON_USEDEP}]
+			dev-python/pytest[${PYTHON_USEDEP}]
+			dev-python/pytest-xdist[${PYTHON_USEDEP}]
+		')
+	)
+"
+PDEPEND="
+	>=app-shells/gentoo-bashcomp-20140911
+"
+
+PATCHES=(
+	"${FILESDIR}"/${PN}-2.14.0-optimize-kernel-modules.patch
+	"${FILESDIR}"/${PN}-2.16.0-libsecret-completion.patch
+)
+
+strip_completions() {
+	# Remove unwanted completions.
+	local strip_completions=(
+		# Slackware package stuff, quite generic names cause collisions
+		# (e.g. with sys-apps/pacman)
+		explodepkg installpkg makepkg pkgtool removepkg upgradepkg
+
+		# Debian/Red Hat network stuff
+		ifdown ifup ifquery ifstatus
+
+		# Installed in app-editors/vim-core
+		xxd
+
+		# Now-dead symlinks to deprecated completions
+		hd ncal
+
+		# For GNU mailman, which isn't packaged. If mailman isn't installed,
+		# it triggers a QA warning.
+		arch
+	)
+
+	local file
+	for file in "${strip_completions[@]}"; do
+		rm "${ED}"/usr/share/bash-completion/completions/${file} ||
+			die "stripping ${file} failed"
+	done
+
+	# remove deprecated completions (moved to other packages)
+	rm "${ED}"/usr/share/bash-completion/completions/_* || die
+}
+
+python_check_deps() {
+	python_has_version "dev-python/pexpect[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest[${PYTHON_USEDEP}]" &&
+	python_has_version "dev-python/pytest-xdist[${PYTHON_USEDEP}]"
+}
+
+pkg_setup() {
+	use test && python-any-r1_pkg_setup
+}
+
+src_prepare() {
+	if use eselect; then
+		eapply "${WORKDIR}/${BASHCOMP_P}/bash-completion-blacklist-support.patch"
+	fi
+
+	default
+	# Only needed for ${PN}-2.16.0-libsecret-completion.patch
+	eautoreconf
+}
+
+src_test() {
+	local EPYTEST_DESELECT=(
+		# redhat-specific, we strip these completions
+		test/t/test_if{down,up}.py
+		# not available for icedtea
+		test/t/test_javaws.py
+		# TODO
+		test/t/test_vi.py::TestVi::test_2
+		test/t/test_xmlwf.py::TestXmlwf::test_2 #bug 886159
+		test/t/test_xrandr.py::TestXrandr::test_output_filter
+		test/t/unit/test_unit_dequote.py
+		test/t/test_sudo.py::TestSudo::test_1 #bug 935400
+		test/t/test_xfreerdp.py::TestXfreerdp::test_6 #bug 935400
+		test/t/unit/test_unit_command_offset.py::TestUnitCommandOffset::test_cmd_quoted #bug 931744
+		test/t/test_make.py::TestMake::test_6 #bug 931744
+	)
+	local EPYTEST_IGNORE=(
+		# stupid test that async tests work
+		test/fixtures/pytest/test_async.py
+	)
+	local EPYTEST_XDIST=1
+
+	# portage's HOME override breaks tests
+	local -x HOME=$(unset HOME; echo ~)
+	addpredict "${HOME}"
+	# used in pytest tests
+	local -x NETWORK=none
+	local -x PYTEST_DISABLE_PLUGIN_AUTOLOAD=1
+	local -x PYTEST_PLUGINS=xdist.plugin
+	emake -C completions check
+	epytest
+}
+
+src_install() {
+	# work-around race conditions, bug #526996
+	mkdir -p "${ED}"/usr/share/bash-completion/{completions,helpers} || die
+
+	emake DESTDIR="${D}" profiledir="${EPREFIX}"/etc/bash/bashrc.d install
+
+	strip_completions
+
+	dodoc AUTHORS CHANGELOG.md CONTRIBUTING.md README.md
+
+	# install the python completions for all targets, bug #622892
+	local TARGET
+	for TARGET in "${PYTHON_COMPAT[@]}"; do
+		if [[ ! -e "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.} ]]; then
+			dosym python "${ED}"/usr/share/bash-completion/completions/${TARGET/_/.}
+		fi
+	done
+
+	# install the eselect module
+	if use eselect; then
+		insinto /usr/share/eselect/modules
+		doins "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect"
+		doman "${WORKDIR}/${BASHCOMP_P}/bashcomp.eselect.5"
+	fi
+}
+
+pkg_postinst() {
+	if has_version 'app-shells/zsh'; then
+		elog
+		elog "If you are interested in using the provided bash completion functions with"
+		elog "zsh, valuable tips on the effective use of bashcompinit are available:"
+		elog "  http://www.zsh.org/mla/workers/2003/msg00046.html"
+		elog
+	fi
+}

sdk_container/src/third_party/portage-stable/app-shells/bash-completion/files/bash-completion-2.16.0-libsecret-completion.patch

@@ -0,0 +1,68 @@
+https://github.com/scop/bash-completion/issues/1317
+https://github.com/scop/bash-completion/commit/af8a80d8916edd4a1c146afb2743651b6c3ca406
+
+From af8a80d8916edd4a1c146afb2743651b6c3ca406 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Ville=20Skytt=C3=A4?= <ville.skytta@iki.fi>
+Date: Tue, 21 Jan 2025 23:54:41 +0200
+Subject: [PATCH] refactor(secret-tool): deprecate ours in favor of upstream
+
+Closes https://github.com/scop/bash-completion/issues/1317
+---
+ completions/Makefile.am                   | 2 +-
+ completions/{secret-tool => _secret-tool} | 3 +++
+ test/fallback/completions/Makefile.am     | 1 +
+ test/fallback/completions/secret-tool     | 1 +
+ 4 files changed, 6 insertions(+), 1 deletion(-)
+ rename completions/{secret-tool => _secret-tool} (93%)
+ create mode 120000 test/fallback/completions/secret-tool
+
+diff --git a/completions/Makefile.am b/completions/Makefile.am
+index 899bec5259d..21b6f9e49f0 100644
+--- a/completions/Makefile.am
++++ b/completions/Makefile.am
+@@ -398,7 +398,7 @@ cross_platform = 2to3 \
+ 		sbopkg \
+ 		screen \
+ 		scrub \
+-		secret-tool \
++		_secret-tool \
+ 		set \
+ 		sh \
+ 		sha256sum \
+diff --git a/completions/secret-tool b/completions/_secret-tool
+similarity index 93%
+rename from completions/secret-tool
+rename to completions/_secret-tool
+index e8aafd81aef..862bfa8c73d 100644
+--- a/completions/secret-tool
++++ b/completions/_secret-tool
+@@ -1,5 +1,8 @@
+ # bash completion for secret-tool(1)                       -*- shell-script -*-
+ 
++# Use of this file is deprecated. Upstream completion is available in
++# libsecret >= 0.20.5, use that instead.
++
+ _comp_cmd_secret_tool()
+ {
+     local cur prev words cword was_split comp_args
+diff --git a/test/fallback/completions/Makefile.am b/test/fallback/completions/Makefile.am
+index 28358b4e7d6..24e9c9755ff 100644
+--- a/test/fallback/completions/Makefile.am
++++ b/test/fallback/completions/Makefile.am
+@@ -46,6 +46,7 @@ EXTRA_DIST = \
+ 	ruff \
+ 	runuser \
+ 	rustup \
++	secret-tool \
+ 	slackpkg \
+ 	sops \
+ 	stern \
+diff --git a/test/fallback/completions/secret-tool b/test/fallback/completions/secret-tool
+new file mode 120000
+index 00000000000..ab0a8361057
+--- /dev/null
++++ b/test/fallback/completions/secret-tool
+@@ -0,0 +1 @@
++../../../completions/_secret-tool
+\ No newline at end of file
+

sdk_container/src/third_party/portage-stable/app-shells/bash/Manifest

@@ -22,12 +22,9 @@ DIST bash-5.1.tar.gz 10458638 BLAKE2B 42059556694b604911b5b7936f94d42d8923f2931f
 DIST bash-5.1.tar.gz.sig 95 BLAKE2B ac9209d6a4ab4436c511a7a195594e9036d7d1aef7887972f61a0e97378a9685b882621d7f95f5326b155dc155c41635417ce2ca41ac6d0dda78bd293ea4249f SHA512 3966404c0f683c7ef214fcf283b551e5441af3897009f778308c2e34067d98d57c95561453416a54ca5b1daf9a1288dbf950fe3f13353703cead12f5eec5fad8
 DIST bash-5.2.tar.gz 10950833 BLAKE2B 51b196e710794ebad8eac28c31c93eb99ac1a7db30919a13271e39e1cb66a0672f242df75fc7d71627ea873dfbce53ec35c0c56a71c5167143070a7811343fd9 SHA512 5647636223ba336bf33e0c65e516d8ebcf6932de8b44f37bc468eedb87579c628ad44213f78534beb10f47aebb9c6fa670cb0bed3b4e7717e5faf7e9a1ef81ae
 DIST bash-5.2.tar.gz.sig 95 BLAKE2B 2991b7c46ef1cdca08062f419be47fca7551f4c5d9aad8a5c1da74974f5e7707d23914b4cecf9b6c9610471146b2c49b611bb62a5d974f1c37cceb77b719851c SHA512 a161664f124f906be32709f66702f8f780e6d52e558ea45e71ec60a959c9435ff68477ee65a0a9f6c0051d5592f5044fb3b410cf3cd3ae5a8a323789b01be258
-DIST bash-5.3-rc1.tar.gz 10742642 BLAKE2B 846414fe545da1ee62b541a8861d68e1dc57114276d40c6af2a9ab1f91cedb220d060f1bd81a811d6dacd841cd1b66e0ed7d8462b3c7066ad204f3786d6af0ec SHA512 16a74fcb31a8ea20cf9505a8cee584a02baed1d2c47b75556e4ae6752712db8f9e0b4b202d2cbe77990fec1ff141ff35e410d4495887ed90f5457c032079c5e5
-DIST bash-5.3-rc1.tar.gz.sig 95 BLAKE2B cc7916f92eddd881ac4d791918b7bb579396df4badbd671a7d0664fd814cee37327dce31d288a8fb03bc66a23536873b5fcd72f2e08e294b9ff9f2ef889741e3 SHA512 a275ff17f9318b5626450eeeb9f49157c9b20df974e004adb26f6585c84deea8d68fc0e1670f990096675ecadd652b58895f74c4e40c8e142a3c2ed414145248
-DIST bash-5.3_rc1_p20250409-42c6cbd459a121e98d9ac43c477a5daf6c3d4f0c.tar.gz 15866668 BLAKE2B 472b67d397dd0f4ba070d4899bb1ecde08a90a7d2f5fc16b8f79c7113d2ca66cbc353e128ace17128069ebc7f8560605dda1441019174a942abb0dd345629746 SHA512 43614445ac11d25258ba6c47f020a1b87d8fa33b139e4d2237683ea0465bf24b03cf84e7e2771de4b038bbecab44c923bb307e4a60b9590b42936ea4e7c86e73
-DIST bash-5.3_rc1_p20250419-482872ed8b51408066c3275a18350436f4d0ee41.tar.gz 16004323 BLAKE2B 936b2bf45e90be658105a2755b9a0be046cd5ae50b6d34624ff20199fa93c1de4a8f9ab669c2c9cf86e2e4d6379f124d91141354d41d437536931cd157491626 SHA512 f04eb6c45124a66fc894c4a1f217351a0247ddd870cfcbbcd01bcff77369d022c6ca82f693c6f2fcd035ce5a67ab3fdbc902b30a4c76e84fdaddd25eeb7c407f
-DIST bash-5.3_rc1_p20250422-7731dc5c4d405ab147fc562e3af2a375ca593554.tar.gz 15996966 BLAKE2B 6a9c720b2747ccff7d8d198354163b6e0645b8a8e436a65e5d1f86ad509b8f197d95ba7cd4097ec4558911d73f98817da65f90a879215b8ad243388e1fdd75df SHA512 21847abf8019776f310c1de8f7469823c233039fa95ca1f872071580f917c728ac767f6daa778dfcfa0fd7583edf07b7928075d5086f3711d68a45ea3133857f
-DIST bash-5.3_rc1_p20250430-15df5993542463ba9798e4ea5e488dfddf83c276.tar.gz 15996459 BLAKE2B 013768ddce578a50845f1709a276b80474999e83172d32d4ba1978a795c17fbd2c77d3812a631ade937afa9a0850ee40f45dcd8b02251fce8c3d0619b82de33d SHA512 e86edefd13e9863c059411587377393b5dc290bf42d1bb5f3684e4a881a0ea10f554b22752f3632b1fc29ff8be08ec1ace8f729639b55ec97eb77968886856fd
+DIST bash-5.3-rc2.tar.gz 11032468 BLAKE2B 42f3b6b3b675a618c965fbde8e3052ac4e171b0f50848589ab4996f6a8de22aca8bdaa5819eb21d3e3dbd67cddaad17d8c48d5a977ae77373fedfdec67cb4155 SHA512 8dfd16723ea14a5901f3a056d30a0fa7b633e41495bbf071897f6a7794293dec59e4eb8618345aeb9e06a924e87c8b823e3ab1e3888a963421b1e8398cc0c12e
+DIST bash-5.3-rc2.tar.gz.sig 95 BLAKE2B 2068f4b5e5045f00a389256c8e753253a1f9b7d06970c51516555e463ef3d5e682e28a9052a2fbae0f9ce7bb0f9e31116a0a780ae3dc7d083a71591feee6501d SHA512 2a4cad6d8f5212319045b6139fb8e3c56664efa5ffcf1ef522219f5a100d5385ab627f6c122f9b49178b48e9c2a85da43f72fd70425547c3a71c0ec1ae812e33
+DIST bash-5.3_rc2_p20250606-727b8d366390fea446f7a566c4be1be6c0e2a765.tar.gz 16083935 BLAKE2B 05821cd7598a6915651ca5f0f9c601ea4e118406d3db652c0989cebe32d15a03e1c95b517740834564e27be1d1e312aa2433f4456a4a8307249d2cfd9fd471fd SHA512 f9f8b17efd119fb0d82251a5be7ead3af8502461116036ffb22b4318f924d97927f1ec010982a21fb0f6fe39ad78e0ccbedfd66a469bb20ed4006bb39595ae4e
 DIST bash205b-001 1132 BLAKE2B 0c5eef29777d54ef05957ea3d63b1556fb380bd20c238dc28993d822b37bc4e78ff4048ad069f6b8cd25da77ccdeb7aecd86c4349cb9d81e5e94c7001eeae5e6 SHA512 5ce4357468821b05e747201f3aa57225ad8f540c9e2c87051720490e039c30b478b9b662a68f14a0800fefe40184e4495e2645665200f9d75e9a115b2ac08071
 DIST bash205b-002 755 BLAKE2B 6a6ed5679d451f02f8104b345c1722d11718ce3b4043b581c17786d40d8da69a34786fb56d0c363dba277b8e9dd33f12f70c9cc73a9fc39ba4a8319406f0458d SHA512 46947b0229478d5c2cfeff68b8ebc00e4ef0c8b94e336ca12f72b4490ba3622c0240c01c17c1641c3b07adc2c64ec94d6d780365e8990768ec8888f3a9526883
 DIST bash205b-003 2356 BLAKE2B b7887d00d92fd298cd07a15e1c73b516dabd22ecd74c97091636dd97a0cd55024ed698e5cc924c4311d994dd326b1ad074bea35e7650cf9cf4e25c60d2713fa7 SHA512 74528ca5d165b812d299f1c69b47757bd677c0b22ce4217e155cd641708b02364a93c6709fb57b546b376b36da74429a61493921c7c199563da40ddcf1c1f399